<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>Frida all in one | Forgo7ten'blog</title><meta name="keywords" content="Android逆向"><meta name="author" content="Forgo7ten"><meta name="copyright" content="Forgo7ten"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="[TOC] Frida all in one ¶  努力ALL IN ONE，部分代码可配合AndroidReversePractice&#x2F;FridaTestApp at main · Forgo7ten&#x2F;AndroidReversePractice (github.com)试验。 JavaScript API | Frida • A world-class dynamic instrumentat">
<meta property="og:type" content="article">
<meta property="og:title" content="Frida all in one">
<meta property="og:url" content="https://forgo7ten.github.io/AndroidReverse/2022/Frida_all_in_one/index.html">
<meta property="og:site_name" content="Forgo7ten&#39;blog">
<meta property="og:description" content="[TOC] Frida all in one ¶  努力ALL IN ONE，部分代码可配合AndroidReversePractice&#x2F;FridaTestApp at main · Forgo7ten&#x2F;AndroidReversePractice (github.com)试验。 JavaScript API | Frida • A world-class dynamic instrumentat">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://forgo7ten.gitee.io/store/imgs/14.jpg">
<meta property="article:published_time" content="2022-04-22T16:00:00.000Z">
<meta property="article:modified_time" content="2022-04-22T16:00:00.000Z">
<meta property="article:author" content="Forgo7ten">
<meta property="article:tag" content="Android逆向">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://forgo7ten.gitee.io/store/imgs/14.jpg"><link rel="shortcut icon" href="/images/favicon.jpg"><link rel="canonical" href="https://forgo7ten.github.io/AndroidReverse/2022/Frida_all_in_one/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//hm.baidu.com"/><link rel="preconnect" href="//www.clarity.ms"/><link rel="preconnect" href="//fonts.googleapis.com" crossorigin=""/><link rel="preconnect" href="//busuanzi.ibruce.info"/><meta name="google-site-verification" content="8L0ZjthONyq6-m7FniRTH8A7Bh0x-KOPZbKOcNimnYA"/><meta name="baidu-site-verification" content="code-gjVsyPt7yr"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.css" media="print" onload="this.media='all'"><script>var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?b076845d73a4f28b3c7401b2a0a8a9db";
  var s = document.getElementsByTagName("script")[0]; 
  s.parentNode.insertBefore(hm, s);
})();
</script><script>(function(c,l,a,r,i,t,y){
    c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};
    t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;
    y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);
})(window, document, "clarity", "script", "9zbibmmffi");</script><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Titillium+Web&amp;display=swap" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: {"path":"search.xml","languages":{"hits_empty":"找不到您查询的内容：${query}"}},
  translate: {"defaultEncoding":2,"translateDelay":0,"msgToTraditionalChinese":"繁","msgToSimplifiedChinese":"簡"},
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":300},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: true,
    post: false
  },
  runtime: '天',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: {"chs_to_cht":"你已切换为繁体","cht_to_chs":"你已切换为简体","day_to_night":"你已切换为深色模式","night_to_day":"你已切换为浅色模式","bgLight":"#49b1f5","bgDark":"#121212","position":"bottom-left"},
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: true,
  isAnchor: true
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: 'Frida all in one',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2022-04-23 00:00:00'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="Forgo7ten'blog" type="application/atom+xml">
</head><body><div id="loading-box"><div class="loading-left-bg"></div><div class="loading-right-bg"></div><div class="spinner-box"><div class="configure-border-1"><div class="configure-core"></div></div><div class="configure-border-2"><div class="configure-core"></div></div><div class="loading-word">加载中...</div></div></div><div id="web_bg"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/images/avatar.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data is-center"><div class="data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">20</div></a></div><div class="data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">8</div></a></div><div class="data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">6</div></a></div></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/14.jpg')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">Forgo7ten'blog</a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">Frida all in one</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2022-04-22T16:00:00.000Z" title="发表于 2022-04-23 00:00:00">2022-04-23</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2022-04-22T16:00:00.000Z" title="更新于 2022-04-23 00:00:00">2022-04-23</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Android%E9%80%86%E5%90%91/">Android逆向</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-wordcount"><i class="far fa-file-word fa-fw post-meta-icon"></i><span class="post-meta-label">字数总计:</span><span class="word-count">9.1k</span><span class="post-meta-separator">|</span><i class="far fa-clock fa-fw post-meta-icon"></i><span class="post-meta-label">阅读时长:</span><span>45分钟</span></span><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="Frida all in one"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><p>[TOC]</p>
<h1 id="Frida-all-in-one">Frida all in one<a class="header-anchor" href="#Frida-all-in-one"> ¶ </a></h1>
<p>努力ALL IN ONE，部分代码可配合<a target="_blank" rel="noopener" href="https://github.com/Forgo7ten/AndroidReversePractice/tree/main/FridaTestApp">AndroidReversePractice/FridaTestApp at main · Forgo7ten/AndroidReversePractice (github.com)</a>试验。</p>
<p><a target="_blank" rel="noopener" href="https://frida.re/docs/javascript-api/">JavaScript API | Frida • A world-class dynamic instrumentation framework</a></p>
<h2 id="Frida环境与基础使用">Frida环境与基础使用<a class="header-anchor" href="#Frida环境与基础使用"> ¶ </a></h2>
<h3 id="多python-frida版本切换">多python frida版本切换<a class="header-anchor" href="#多python-frida版本切换"> ¶ </a></h3>
<h4 id="pyenv安装">pyenv安装<a class="header-anchor" href="#pyenv安装"> ¶ </a></h4>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">curl -L https://gitee.com/forgo7ten-mirrors/pyenv-installer/raw/master/bin/pyenv-installer | bash</span><br><span class="line"><span class="built_in">cd</span> ~/.pyenv &amp;&amp; src/configure &amp;&amp; make -C src</span><br></pre></td></tr></table></figure>
<p>.bashrc添加</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># pyenv start</span></span><br><span class="line"><span class="built_in">export</span> PYENV_ROOT=<span class="string">&quot;<span class="variable">$HOME</span>/.pyenv&quot;</span></span><br><span class="line"><span class="built_in">export</span> PATH=<span class="string">&quot;<span class="variable">$PYENV_ROOT</span>/bin:<span class="variable">$PATH</span>&quot;</span></span><br><span class="line"><span class="built_in">export</span> PATH=<span class="string">&quot;<span class="variable">$PYENV_ROOT</span>/shims:<span class="variable">$PATH</span>&quot;</span></span><br><span class="line"><span class="keyword">if</span> <span class="built_in">command</span> -v pyenv 1&gt;/dev/null 2&gt;&amp;1; <span class="keyword">then</span></span><br><span class="line"> <span class="built_in">eval</span> <span class="string">&quot;<span class="subst">$(pyenv init -)</span>&quot;</span></span><br><span class="line"><span class="keyword">fi</span></span><br><span class="line"><span class="built_in">eval</span> <span class="string">&quot;<span class="subst">$(pyenv virtualenv-init -)</span>&quot;</span></span><br><span class="line"><span class="comment"># pyenv end</span></span><br></pre></td></tr></table></figure>
<h4 id="pyenv使用">pyenv使用<a class="header-anchor" href="#pyenv使用"> ¶ </a></h4>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 下载python版本3.8.2</span></span><br><span class="line">pyenv install 3.8.2</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看pyenv版本</span></span><br><span class="line">pyenv versions</span><br><span class="line"></span><br><span class="line"><span class="comment"># 切换某个python版本</span></span><br><span class="line">pyenv <span class="built_in">local</span> 3.8.2</span><br><span class="line"></span><br><span class="line"><span class="comment"># 切换到系统python版本</span></span><br><span class="line">python <span class="built_in">local</span> system</span><br></pre></td></tr></table></figure>
<h3 id="Frida环境安装">Frida环境安装<a class="header-anchor" href="#Frida环境安装"> ¶ </a></h3>
<p>需前往<a target="_blank" rel="noopener" href="https://pypi.org/project/frida/#files">frida · PyPI</a>查看支持python版本（如frida 15.0.13不支持python3.7）</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">pip install frida-tools</span><br></pre></td></tr></table></figure>
<p>安装特定版本（<strong>使用pip默认源</strong>）</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 使用虚拟环境</span></span><br><span class="line">python 3.8.5 frida_12_8_0</span><br><span class="line">pyenv <span class="built_in">local</span> frida_12_8_0</span><br><span class="line">pip install wheel</span><br><span class="line">pip install frida==12.8.0</span><br><span class="line">pip install frida-tools==5.3.0</span><br><span class="line">pip install objection==1.8.4</span><br><span class="line"></span><br><span class="line">python 3.8.6 frida_14_2_18</span><br><span class="line">pyenv <span class="built_in">local</span> frida_14_2_18</span><br><span class="line">pip install frida==14.2.18</span><br><span class="line">pip install frida-tools==9.2.4</span><br><span class="line">pip install objection==1.11.0</span><br><span class="line"></span><br><span class="line">python 3.8.8 frida_15_1_28</span><br><span class="line">pyenv <span class="built_in">local</span> frida_15_1_28</span><br><span class="line">pip install frida==15.1.28</span><br><span class="line">pip install frida-tools==10.8.0</span><br><span class="line">pip install objection==1.11.0</span><br></pre></td></tr></table></figure>
<p><a target="_blank" rel="noopener" href="https://github.com/frida/frida/releases/tag/12.8.0">Release Frida 12.8.0 · frida/frida (github.com)</a></p>
<h4 id="手机环境配置">手机环境配置<a class="header-anchor" href="#手机环境配置"> ¶ </a></h4>
<p>前往<a target="_blank" rel="noopener" href="https://github.com/frida/frida/releases/">Releases · frida/frida (github.com)</a>下载对应的<code>frida-server</code>文件，<strong>frida-server版本要和frida版本一致</strong></p>
<p>push到设备目录，赋予执行权限</p>
<h5 id="监听">监听<a class="header-anchor" href="#监听"> ¶ </a></h5>
<p>设置端口号为8888</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">./frida -l 0.0.0.0:8888</span><br></pre></td></tr></table></figure>
<h3 id="Objection环境安装">Objection环境安装<a class="header-anchor" href="#Objection环境安装"> ¶ </a></h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">pip install objection</span><br></pre></td></tr></table></figure>
<h3 id="Frida开发环境搭建">Frida开发环境搭建<a class="header-anchor" href="#Frida开发环境搭建"> ¶ </a></h3>
<blockquote>
<p>全局获得代码提示（在用户根目录使用）</p>
  <figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">npm install --save @types/frida-gum</span><br><span class="line"><span class="comment"># --save到当前目录</span></span><br></pre></td></tr></table></figure>
</blockquote>
<p>或者ts编译</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">git <span class="built_in">clone</span> https://gitee.com/Forgo7ten/frida-agent-example.git</span><br><span class="line"><span class="built_in">cd</span> frida-agent-example/</span><br><span class="line">npm install</span><br></pre></td></tr></table></figure>
<p>在<code>agent</code>目录下编写</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/** test.js **/</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> <span class="title">x</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;Hello Frida&quot;</span>)</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br><span class="line">setImmediate(main)</span><br></pre></td></tr></table></figure>
<p>控制台执行</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">frida -H 192.168.0.106:8888 -f com.android.settings -l test.js --no-pause</span><br><span class="line"></span><br><span class="line">-H：设置主机和端口号</span><br><span class="line">-f：启动某个应用（packagename）</span><br><span class="line">-l：执行的js文件</span><br></pre></td></tr></table></figure>
<ul>
<li><code>npm run watch</code>会监控代码修改自动编译生成js文件</li>
</ul>
<p><strong>或者</strong>python脚本执行</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># loader.py</span></span><br><span class="line"><span class="keyword">import</span> time</span><br><span class="line"><span class="keyword">import</span> frida</span><br><span class="line"></span><br><span class="line"><span class="comment"># 获取指定 UID/远程 设备</span></span><br><span class="line">device = frida.get_device_manager().add_remote_device(<span class="string">&quot;192.168.0.103:8888&quot;</span>)</span><br><span class="line"><span class="comment"># 寻找某apk包名</span></span><br><span class="line">pid = device.spawn(<span class="string">&quot;com.android.settings&quot;</span>)</span><br><span class="line">device.resume(pid)</span><br><span class="line">time.sleep(<span class="number">1</span>)</span><br><span class="line">session = device.attach(pid)</span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;test.js&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">    <span class="comment"># 创建js脚本</span></span><br><span class="line">    script = session.create_script(f.read())</span><br><span class="line"><span class="comment"># 加载js脚本</span></span><br><span class="line">script.load()</span><br></pre></td></tr></table></figure>
<h3 id="Objection使用">Objection使用<a class="header-anchor" href="#Objection使用"> ¶ </a></h3>
<h4 id="Objection基本使用">Objection基本使用<a class="header-anchor" href="#Objection基本使用"> ¶ </a></h4>
<p>objection启动并注入内存</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">objection -N -h [hostname] -p [port] -d -g [packagename] explore</span><br><span class="line"><span class="comment"># -N 指定网络连接</span></span><br><span class="line"><span class="comment"># -h 指定主机名</span></span><br><span class="line"><span class="comment"># -p 指定端口</span></span><br><span class="line"><span class="comment"># -d 启用debug模式</span></span><br><span class="line"><span class="comment"># -g 打开的app包名</span></span><br></pre></td></tr></table></figure>
<p><strong>memory</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 查看内存中加载的库</span></span><br><span class="line">memory list modules</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看库的导出函数</span></span><br><span class="line">memory list exports [modulename]</span><br><span class="line"></span><br><span class="line"><span class="comment"># 结果保存到文件（以json形式）</span></span><br><span class="line">memory list exports [modulename] --json [filename]</span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 提取整个内存</span></span><br><span class="line">memory dump all [filename]</span><br><span class="line"></span><br><span class="line"><span class="comment"># 提取部分内存</span></span><br><span class="line">memory dump from_base [start_addr] [length] [file_name]</span><br></pre></td></tr></table></figure>
<p><strong>android</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 搜索类的实例</span></span><br><span class="line">android heap search instances [class_name]</span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 主动调用实例方法</span></span><br><span class="line">android heap execute [instance_handle] [method_name]</span><br><span class="line"></span><br><span class="line"><span class="comment"># 在实例上执行js代码</span></span><br><span class="line">android heap evaluate [instance_handle] &#123;Enter&#125;</span><br><span class="line"><span class="comment">## 输入js代码 ## (clazz代表当前类 )</span></span><br></pre></td></tr></table></figure>
<p><strong>启动activity或service</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 启动activity</span></span><br><span class="line">android intent launch_activity [activity]</span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 启动service</span></span><br><span class="line">android intent launch_service [service]</span><br></pre></td></tr></table></figure>
<p><strong>hooking</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 查看内存中的activity</span></span><br><span class="line">android hooking list activities</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看内存中的service</span></span><br><span class="line">android hooking list services</span><br><span class="line"></span><br><span class="line"><span class="comment"># 查看内存中所有的类</span></span><br><span class="line">android hooking list classes</span><br><span class="line"></span><br><span class="line"><span class="comment"># 列出某个类的所有方法</span></span><br><span class="line">android hooking list class_methods [class]</span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 搜索包含特定关键词的类</span></span><br><span class="line">android hooking search classes [string]</span><br><span class="line"></span><br><span class="line"><span class="comment"># 内存中搜索包含特定关键词的方法</span></span><br><span class="line">android hooking search methods [string]</span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 生成该类所有方法的hook，每次调用都会被log</span></span><br><span class="line">android hooking generate simple [class]</span><br><span class="line"></span><br><span class="line"><span class="comment"># 附带参数：额外打印参数，调用栈，返回值</span></span><br><span class="line">android hooking watch class [class_method] --dump-args --dump-backtrace --dump-return</span><br><span class="line"></span><br><span class="line"><span class="comment"># hook某方法(同时会hook所有重载)</span></span><br><span class="line">android hooking watch [class_method] [method_name]</span><br></pre></td></tr></table></figure>
<p><strong>objection jobs</strong></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 查看jobs列表（当有hook任务时）</span></span><br><span class="line"><span class="built_in">jobs</span> list</span><br><span class="line"></span><br><span class="line"><span class="comment"># 删除任务 JobID通过list得到</span></span><br><span class="line"><span class="built_in">jobs</span> <span class="built_in">kill</span> [JobID]</span><br></pre></td></tr></table></figure>
<h4 id="objection插件">objection插件<a class="header-anchor" href="#objection插件"> ¶ </a></h4>
<p>插件使用</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">plugin load [FileUrl]</span><br></pre></td></tr></table></figure>
<h4 id="Wallbreaker"><a target="_blank" rel="noopener" href="https://github.com/hluwa/Wallbreaker">Wallbreaker</a><a class="header-anchor" href="#Wallbreaker"> ¶ </a></h4>
<h4 id="FRIDA-DEXDump"><a target="_blank" rel="noopener" href="https://github.com/hluwa/FRIDA-DEXDump">FRIDA-DEXDump</a><a class="header-anchor" href="#FRIDA-DEXDump"> ¶ </a></h4>
<h4 id="objection高级使用">objection高级使用<a class="header-anchor" href="#objection高级使用"> ¶ </a></h4>
<p>objection spawn进程（hook某些一启动就执行的app）</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">objection -d -g [packageName] explore --startup-command <span class="string">&#x27;android hooking watch class xxx&#x27;</span></span><br></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">objection -d -g [packageName] explore -c commands.txt</span><br></pre></td></tr></table></figure>
<h2 id="Frida-Java层应用">Frida Java层应用<a class="header-anchor" href="#Frida-Java层应用"> ¶ </a></h2>
<h3 id="hook方法">hook方法<a class="header-anchor" href="#hook方法"> ¶ </a></h3>
<h4 id="hook静态方法与实例方法">hook静态方法与实例方法<a class="header-anchor" href="#hook静态方法与实例方法"> ¶ </a></h4>
<p>Frida对静态方法与实例方法没有区分，直接hook即可。</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="comment">// 先查找HookedObject类，然后hook其的stringTwo方法</span></span><br><span class="line">            Java.use(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>).stringTwo.implementation = <span class="function"><span class="keyword">function</span> (<span class="params">arg</span>) </span>&#123;</span><br><span class="line">              <span class="comment">// this为当前实例，获得原方法执行的结果</span></span><br><span class="line">              <span class="keyword">var</span> result = <span class="built_in">this</span>.stringTwo(arg);</span><br><span class="line">              <span class="comment">// 打印参数和原方法结果</span></span><br><span class="line">              <span class="built_in">console</span>.log(<span class="string">&quot;stringTwo arg,result: &quot;</span>, arg, result);</span><br><span class="line">              <span class="comment">// 对方法的结果进行修改（相当于重写了该方法）</span></span><br><span class="line">              <span class="keyword">return</span> Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;hhello&quot;</span>);</span><br><span class="line">            &#125;;</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">// Frida一附加上，就执行函数</span></span><br><span class="line">setImmediate(main);</span><br></pre></td></tr></table></figure>
<h4 id="hook构造方法">hook构造方法<a class="header-anchor" href="#hook构造方法"> ¶ </a></h4>
<p>构造方法为<code>$init</code>，例如</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">function <span class="title">main2</span><span class="params">()</span> </span>&#123;</span><br><span class="line">    Java.perform(function()&#123;</span><br><span class="line">        <span class="comment">// hook有重载的无参方法时，overload()填空</span></span><br><span class="line">        Java.use(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>).$init.overload().implementation = function () &#123;</span><br><span class="line">            <span class="comment">// this为当前实例，获得原方法执行的结果</span></span><br><span class="line">            <span class="keyword">var</span> result = <span class="keyword">this</span>.$init();</span><br><span class="line">            <span class="comment">// 可以打印参数和原方法结果</span></span><br><span class="line">            console.log(<span class="string">&quot;call $init&quot;</span>);</span><br><span class="line">            <span class="comment">// 返回原方法执行的结果</span></span><br><span class="line">            <span class="keyword">return</span> result;</span><br><span class="line">        &#125;;</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="对方法重载的hook">对方法重载的hook<a class="header-anchor" href="#对方法重载的hook"> ¶ </a></h4>
<p>使用<code>.overload()</code>来确定hook哪个重载方法</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// hook addNumber方法 function参数列表可以什么都不填</span></span><br><span class="line">        Java.use(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>).addNumber.overload(<span class="string">&quot;int&quot;</span>, <span class="string">&quot;int&quot;</span>).implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="comment">// 内置有变量[argument]，为方法的参数列表</span></span><br><span class="line">            <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; <span class="built_in">arguments</span>.length; i++) &#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;addNumber arguments[&quot;</span> + i + <span class="string">&quot;]=&quot;</span> + <span class="built_in">arguments</span>[i]);</span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">var</span> result = <span class="built_in">this</span>.addNumber(<span class="built_in">arguments</span>[<span class="number">0</span>], <span class="built_in">arguments</span>[<span class="number">1</span>]);</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;addNumber arg,result: &quot;</span>, <span class="built_in">arguments</span>, result);</span><br><span class="line">            <span class="keyword">return</span> <span class="number">99</span>;</span><br><span class="line">        &#125;;</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">// Frida一附加上，就执行函数</span></span><br><span class="line">setImmediate(main);</span><br></pre></td></tr></table></figure>
<h4 id="hook指定方法的所有重载">hook指定方法的所有重载<a class="header-anchor" href="#hook指定方法的所有重载"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">hookMethodAllOverloads</span>(<span class="params">className, methodName</span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// hook 指定方法的所有重载</span></span><br><span class="line">        <span class="keyword">var</span> clazz = Java.use(className);</span><br><span class="line">        <span class="comment">// Object.toString同Object[&quot;toString&quot;]</span></span><br><span class="line">        <span class="keyword">var</span> overloadsLength = clazz[methodName].overloads.length;</span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; overloadsLength; i++) &#123;</span><br><span class="line">            clazz[methodName].overloads[i].implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="comment">// 主动调用原方法获得结果</span></span><br><span class="line">                <span class="keyword">var</span> result = <span class="built_in">this</span>[methodName].apply(<span class="built_in">this</span>, <span class="built_in">arguments</span>);</span><br><span class="line">                <span class="keyword">var</span> paramStr = <span class="string">&quot;&quot;</span>;</span><br><span class="line">                <span class="comment">// 遍历arguments</span></span><br><span class="line">                <span class="keyword">for</span> (<span class="keyword">var</span> j = <span class="number">0</span>; j &lt; <span class="built_in">arguments</span>.length; j++) &#123;</span><br><span class="line">                    <span class="keyword">if</span> (j == <span class="built_in">arguments</span>.length - <span class="number">1</span>) &#123;</span><br><span class="line">                        paramStr += <span class="built_in">arguments</span>[j];</span><br><span class="line">                    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                        paramStr += <span class="built_in">arguments</span>[j] + <span class="string">&quot;,&quot;</span>;</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">// 打印参数以及结果</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Called&quot;</span>, className + <span class="string">&quot;.&quot;</span> + methodName + <span class="string">&quot;(&quot;</span> + paramStr + <span class="string">&quot;) :&quot;</span>, result);</span><br><span class="line">                <span class="comment">// 调用原方法</span></span><br><span class="line">                <span class="keyword">return</span> result;</span><br><span class="line">            &#125;;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;[&quot;</span> + overloadsLength + <span class="string">&quot;]&quot;</span>, className + <span class="string">&quot;.&quot;</span> + methodName, <span class="string">&quot;Hooked!&quot;</span>);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> className = <span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>;</span><br><span class="line">    <span class="keyword">var</span> methodName = <span class="string">&quot;addNumber&quot;</span>;</span><br><span class="line">    hookMethodAllOverloads(className, methodName);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="hook内部类与匿名类中的方法">hook内部类与匿名类中的方法<a class="header-anchor" href="#hook内部类与匿名类中的方法"> ¶ </a></h4>
<p>内部类获取时<code>className</code>使用<code>$</code>拼接，如：</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">var</span> InnerClazz = Java.use(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject$innerClass&quot;</span>);</span><br></pre></td></tr></table></figure>
<p>匿名类也同样使用<code>$</code>拼接，但其后的要使用smali或者objection内存搜索来查看</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">var</span> clazz = Java.use(<span class="string">&quot;com.forgotten.fridatestapp.MainActivity$1&quot;</span>);</span><br></pre></td></tr></table></figure>
<h4 id="不可见函数名hook">不可见函数名hook<a class="header-anchor" href="#不可见函数名hook"> ¶ </a></h4>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(</span><br><span class="line">    <span class="function">function <span class="title">x</span><span class="params">()</span> </span>&#123;</span><br><span class="line">        <span class="comment">// 定义目标类</span></span><br><span class="line">        <span class="keyword">var</span> targetClass = <span class="string">&quot;com.example.hooktest.MainActivity&quot;</span>;</span><br><span class="line">        <span class="keyword">var</span> hookCls = Java.use(targetClass);</span><br><span class="line">        <span class="comment">// 获得目标类的所有方法</span></span><br><span class="line">        <span class="keyword">var</span> methods = hookCls.class.getDeclaredMethods();</span><br><span class="line">        <span class="comment">// 遍历所有方法名</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i in methods) &#123;</span><br><span class="line">            console.log(methods[i].toString());</span><br><span class="line">            console.log(encodeURIComponent(methods[i].toString().replace(/^.*?\.([^\s\.\(\)]+)\(.*?$/, <span class="string">&quot;$1&quot;</span>)));</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="comment">// 如果有等于不可见字符类的</span></span><br><span class="line">        hookCls[decodeURIComponent(<span class="string">&quot;%D6%8F&quot;</span>)]</span><br><span class="line">            .implementation = function (x) &#123;</span><br><span class="line">                console.log(<span class="string">&quot;original call: fun(&quot;</span> + x + <span class="string">&quot;)&quot;</span>);</span><br><span class="line">                <span class="keyword">var</span> result = <span class="keyword">this</span>[decodeURIComponent(<span class="string">&quot;%D6%8F&quot;</span>)](<span class="number">900</span>);</span><br><span class="line">                <span class="keyword">return</span> result;</span><br><span class="line">            &#125;</span><br><span class="line">    &#125;</span><br><span class="line">)</span><br></pre></td></tr></table></figure>
<h3 id="内存搜索">内存搜索<a class="header-anchor" href="#内存搜索"> ¶ </a></h3>
<h4 id="查找实例对象">查找实例对象<a class="header-anchor" href="#查找实例对象"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 要查找的对象类名</span></span><br><span class="line">        <span class="keyword">var</span> className = <span class="string">&quot;com.forgotten.fridatestapp.MainActivity&quot;</span>;</span><br><span class="line">        Java.choose(className, &#123;</span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">instance</span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Found it!!&quot;</span>, instance);</span><br><span class="line">                <span class="comment">// something to do...</span></span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Search complete!&quot;</span>);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p><strong>保存对象在外部方法使用</strong></p>
<p><code>Java.retain(obj)</code>：复制一份<code>obj</code>的java包装器以便于以后使用。</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">    <span class="keyword">const</span> Activity = Java.use(<span class="string">&quot;android.app.Activity&quot;</span>);</span><br><span class="line">    <span class="keyword">let</span> lastActivity = <span class="literal">null</span>;</span><br><span class="line">    Activity.onResume.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        lastActivity = Java.retain(<span class="built_in">this</span>);</span><br><span class="line">        <span class="built_in">this</span>.onResume();</span><br><span class="line">    &#125;;</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<h4 id="主动调用方法、获取及修改变量">主动调用方法、获取及修改变量<a class="header-anchor" href="#主动调用方法、获取及修改变量"> ¶ </a></h4>
<ul>
<li>
<p>主动调用方法</p>
<ul>
<li>静态方法使用<code>Java.use</code>获得<strong>类</strong>后直接调用</li>
<li>非静态方法需要使用<code>Java.choose</code>查找到<strong>类实例</strong>后进行调用</li>
<li>构造方法为<code>$init</code></li>
<li>对于方法重载
<ul>
<li>可根据传入的参数自动选择重载</li>
<li>或通过<code>.overload().apply()</code>手动选择选择要调用的重载方法</li>
</ul>
</li>
</ul>
</li>
<li>
<p>静态/非静态变量</p>
<ul>
<li>获取成员变量：<code>[field].value</code>
<ul>
<li>获取静态成员的值：使用<strong>类</strong>或者<strong>类实例</strong>。</li>
<li>获取非静态成员的值：内存搜索到<strong>类实例</strong>后获取。</li>
</ul>
</li>
<li>设置成员变量的值，写法是<code>[field_name].value = [value]</code>，其他方面和函数一样。</li>
<li>如果有一个成员变量和成员函数的名字相同，则在其前面加一个<code>_</code>，如<code>_[field_name].value = [value]</code></li>
</ul>
</li>
</ul>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">invoke</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 在内存中搜索类的实例</span></span><br><span class="line">        Java.choose(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>, &#123;</span><br><span class="line">            <span class="comment">// 如果匹配上执行回调，参数为类实例</span></span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">instance</span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Found `HookedObject` instance:&quot;</span>, instance);</span><br><span class="line">                <span class="comment">// 打印私有成员变量的值，需要[field].value</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;instance.score =&quot;</span>, instance.score.value);</span><br><span class="line">                <span class="comment">// 打印静态成员变量的值</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;HookedObject.msg =&quot;</span>, Java.use(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>).msg.value);</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;instance.msg =&quot;</span>, instance.msg.value);</span><br><span class="line">                <span class="comment">// 修改成员变量的值</span></span><br><span class="line">                instance.score.value = Java.use(<span class="string">&quot;java.lang.Integer&quot;</span>).parseInt(<span class="string">&quot;-900&quot;</span>);</span><br><span class="line">                <span class="comment">// 打印修改之后的值</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;instance.score =&quot;</span>, instance.score.value);</span><br><span class="line">                <span class="comment">// 与方法同名的成员变量，需前面加_</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;instance.stringTwo =&quot;</span>, instance._stringTwo.value);</span><br><span class="line">                </span><br><span class="line">                <span class="comment">// 主动调用方法，根据传入的参数自动选择重载</span></span><br><span class="line">                <span class="built_in">console</span>.log(instance.addNumber(<span class="number">1</span>, <span class="number">2</span>));</span><br><span class="line">                <span class="built_in">console</span>.log(instance.addNumber(<span class="number">4</span>, <span class="number">5</span>, <span class="number">6</span>));</span><br><span class="line">                <span class="comment">// 调用指定方法重载：apply参数一为调用的对象，参数二为参数列表</span></span><br><span class="line">                <span class="built_in">console</span>.log(instance.addNumber.overload(<span class="string">&quot;int&quot;</span>, <span class="string">&quot;int&quot;</span>).apply(instance,[<span class="number">8</span>,<span class="number">9</span>]));</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="comment">// 搜索完成执行回调</span></span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Found Completed&quot;</span>);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h4 id="枚举所有类并hook所有方法">枚举所有类并hook所有方法<a class="header-anchor" href="#枚举所有类并hook所有方法"> ¶ </a></h4>
<p>配合<a href="#hook%E6%8C%87%E5%AE%9A%E6%96%B9%E6%B3%95%E7%9A%84%E6%89%80%E6%9C%89%E9%87%8D%E8%BD%BD">hook指定方法的所有重载</a>来hook所有的方法</p>
<p>使用<code>Java.enumerateLoadedClasses()</code>API</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">        Java.enumerateLoadedClasses(&#123;</span><br><span class="line">            <span class="comment">// name为加载的类名字符串</span></span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span>(<span class="params">name,handle</span>)</span>&#123;</span><br><span class="line">                <span class="comment">// 可以通过包名限定需要处理的类名</span></span><br><span class="line">                <span class="keyword">if</span> (name.indexOf(<span class="string">&quot;com.forgotten.fridatestapp&quot;</span>) != -<span class="number">1</span>)&#123;</span><br><span class="line">                    <span class="built_in">console</span>.log(name,handle);</span><br><span class="line">                    <span class="comment">// 利用反射 获取类中的所有方法</span></span><br><span class="line">                    <span class="keyword">var</span> TargetClass = Java.use(name);</span><br><span class="line">                    <span class="comment">// return Method Object List</span></span><br><span class="line">                    <span class="keyword">var</span> methodsList = TargetClass.class.getDeclaredMethods(); </span><br><span class="line">                    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; methodsList.length; i++)&#123;</span><br><span class="line">                        <span class="comment">// 打印其中方法的名字</span></span><br><span class="line">                        <span class="built_in">console</span>.log(methodsList[i].getName());</span><br><span class="line">                        <span class="comment">// 可以hook该类中的所有方法</span></span><br><span class="line">                        hookMethodAllOverloads(name,methodsList[i].getName());</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;,</span><br><span class="line">            </span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;enumerateLoadedClasses complete!!!&quot;</span>)</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;)</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>使用<code>Java.enumerateLoadedClassesSync()</code>API</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// return String[] class name</span></span><br><span class="line">        <span class="keyword">var</span> classList = Java.enumerateLoadedClassesSync();</span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; classList.length; i++) &#123;</span><br><span class="line">            <span class="keyword">var</span> targetClass = classList[i];</span><br><span class="line">            <span class="keyword">if</span> (targetClass.indexOf(<span class="string">&quot;com.forgotten.fridatestapp&quot;</span>) != -<span class="number">1</span>) &#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;hook the class: &quot;</span>, targetClass);</span><br><span class="line">                <span class="keyword">var</span> TargetClass = Java.use(targetClass);</span><br><span class="line">                <span class="comment">// 利用反射获取类中的所有方法</span></span><br><span class="line">                <span class="keyword">var</span> methodsList = TargetClass.class.getDeclaredMethods();</span><br><span class="line">                <span class="keyword">for</span> (<span class="keyword">var</span> j = <span class="number">0</span>; j &lt; methodsList.length; j++) &#123;</span><br><span class="line">                    <span class="built_in">console</span>.log(methodsList[j].getName());</span><br><span class="line">                    hookMethodAllOverloads(targetClass,methodsList[j].getName());</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="hook动态加载dex">hook动态加载dex<a class="header-anchor" href="#hook动态加载dex"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">findClassLoader</span>(<span class="params">className</span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 枚举内存中的 类加载器</span></span><br><span class="line">        Java.enumerateClassLoaders(&#123;</span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">loader</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">try</span> &#123;</span><br><span class="line">                    <span class="comment">// 如果找到的类加载器 能加载的类有[class_name]</span></span><br><span class="line">                    <span class="keyword">if</span> (loader.findClass(className)) &#123;</span><br><span class="line">                        <span class="built_in">console</span>.log(<span class="string">&quot;Successfully found loader&quot;</span>);</span><br><span class="line">                        <span class="built_in">console</span>.log(loader);</span><br><span class="line">                        <span class="comment">// 设置 java默认的classloader</span></span><br><span class="line">                        Java.classFactory.loader = loader;</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125; <span class="keyword">catch</span> (error) &#123;</span><br><span class="line">                    <span class="built_in">console</span>.log(<span class="string">&quot;find error:&quot;</span> + error);</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;End&quot;</span>);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">        <span class="comment">// 再 使用该类</span></span><br><span class="line">        Java.use(<span class="string">&quot;[class_name]&quot;</span>);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>或使用<code>Java.enumerateClassLoadersSync()</code>API</p>
<h4 id="内存搜索接口">内存搜索接口<a class="header-anchor" href="#内存搜索接口"> ¶ </a></h4>
<h5 id="枚举类的所有接口">枚举类的所有接口<a class="header-anchor" href="#枚举类的所有接口"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">findAllInterfaces</span>(<span class="params">packageName</span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">        Java.enumerateLoadedClasses(&#123;</span><br><span class="line">            <span class="attr">onMatch</span>:<span class="function"><span class="keyword">function</span>(<span class="params">class_name</span>)</span>&#123;</span><br><span class="line">                <span class="comment">//</span></span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(<span class="string">&quot;fridatestapp.DynamicDex&quot;</span>)&gt;=<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">//</span></span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(packageName)&lt;<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;<span class="keyword">else</span>&#123;</span><br><span class="line">                    <span class="keyword">var</span> clazz = Java.use(class_name);</span><br><span class="line">                    <span class="keyword">var</span> interfaces = clazz.class.getInterfaces();</span><br><span class="line">                    <span class="keyword">if</span>(interfaces.length&gt;<span class="number">0</span>)&#123;</span><br><span class="line">                        <span class="built_in">console</span>.log(class_name,<span class="string">&quot;:&quot;</span>);</span><br><span class="line">                        <span class="keyword">for</span>(<span class="keyword">var</span> i <span class="keyword">in</span> interfaces)&#123;</span><br><span class="line">                            <span class="built_in">console</span>.log(<span class="string">&quot;\t&quot;</span>,interfaces[i].toString())</span><br><span class="line">                        &#125;</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>:<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;findAllInterfaces end&quot;</span>);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;)</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> packageName = <span class="string">&quot;com.forgotten.fridatestapp&quot;</span>;</span><br><span class="line">    findAllInterfaces(packageName);</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h5 id="寻找接口的实现类">寻找接口的实现类<a class="header-anchor" href="#寻找接口的实现类"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">findImpByInterface</span>(<span class="params">packageName,interfaceName</span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">        Java.enumerateLoadedClasses(&#123;</span><br><span class="line">            <span class="attr">onMatch</span>:<span class="function"><span class="keyword">function</span>(<span class="params">class_name</span>)</span>&#123;</span><br><span class="line">                <span class="comment">//</span></span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(<span class="string">&quot;fridatestapp.DynamicDex&quot;</span>)&gt;=<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">//</span></span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(packageName)&lt;<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;<span class="keyword">else</span>&#123;</span><br><span class="line">                    <span class="keyword">var</span> clazz = Java.use(class_name);</span><br><span class="line">                    <span class="keyword">var</span> interfaces = clazz.class.getInterfaces();</span><br><span class="line">                    <span class="keyword">if</span>(interfaces.length&gt;<span class="number">0</span>)&#123;</span><br><span class="line">                        <span class="keyword">for</span>(<span class="keyword">var</span> i <span class="keyword">in</span> interfaces)&#123;</span><br><span class="line">                            <span class="keyword">if</span>(interfaces[i].toString().indexOf(interfaceName)&gt;=<span class="number">0</span>)&#123;</span><br><span class="line">                                <span class="built_in">console</span>.log(class_name,<span class="string">&quot;:&quot;</span>,interfaces[i].toString())</span><br><span class="line">                            &#125;</span><br><span class="line">                        &#125;</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>:<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;findImpByInterface end&quot;</span>);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;)</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> packageName = <span class="string">&quot;com.forgotten.fridatestapp&quot;</span>;</span><br><span class="line">    <span class="keyword">var</span> interfaceName = <span class="string">&quot;android.view.View$OnClickListener&quot;</span>;</span><br><span class="line">    findInterface(packageName, interfaceName);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="定位抽象类的实现类">定位抽象类的实现类<a class="header-anchor" href="#定位抽象类的实现类"> ¶ </a></h4>
<h5 id="打印所有类的父类">打印所有类的父类<a class="header-anchor" href="#打印所有类的父类"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">findAllSuperclasses</span>(<span class="params">packageName</span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">        Java.enumerateLoadedClasses(&#123;</span><br><span class="line">            <span class="attr">onMatch</span>:<span class="function"><span class="keyword">function</span>(<span class="params">class_name</span>)</span>&#123;</span><br><span class="line">                <span class="comment">//</span></span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(<span class="string">&quot;fridatestapp.DynamicDex&quot;</span>)&gt;=<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">//</span></span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(packageName)&lt;<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;<span class="keyword">else</span>&#123;</span><br><span class="line">                    <span class="keyword">var</span> hook_cls = Java.use(class_name);</span><br><span class="line">                    <span class="keyword">var</span> superClass = hook_cls.class.getSuperclass();</span><br><span class="line">                    <span class="built_in">console</span>.log(class_name,<span class="string">&quot;:&quot;</span>)</span><br><span class="line">                    <span class="keyword">while</span>(superClass!=<span class="literal">null</span>)&#123;</span><br><span class="line">                        <span class="built_in">console</span>.log(<span class="string">&quot;\t&quot;</span>,superClass.toString());</span><br><span class="line">                        superClass = superClass.getSuperclass();</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>:<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;findAllSuperclasses end&quot;</span>);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;)</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h5 id="寻找继承某类的子类">寻找继承某类的子类<a class="header-anchor" href="#寻找继承某类的子类"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">findChildBySuper</span>(<span class="params">packageName,superClassName</span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        Java.enumerateLoadedClasses(&#123;</span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">class_name</span>) </span>&#123;</span><br><span class="line">                <span class="keyword">if</span>(class_name.indexOf(<span class="string">&quot;DynamicDex&quot;</span>)&gt;=<span class="number">0</span>)&#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">// 对搜索范围进行限定</span></span><br><span class="line">                <span class="keyword">if</span> (class_name.indexOf(packageName) &lt; <span class="number">0</span>) &#123;</span><br><span class="line">                    <span class="keyword">return</span>;</span><br><span class="line">                &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                    <span class="keyword">var</span> hook_cls = Java.use(class_name);</span><br><span class="line">                    <span class="keyword">var</span> superClass = hook_cls.class.getSuperclass();</span><br><span class="line">                    <span class="keyword">while</span>(superClass!=<span class="literal">null</span>)&#123;</span><br><span class="line">                        <span class="keyword">if</span>(superClass.toString().indexOf(superClassName)&gt;=<span class="number">0</span>)&#123;</span><br><span class="line">                            <span class="built_in">console</span>.log(<span class="string">&quot;Found:&quot;</span>,class_name,superClass);</span><br><span class="line">                        &#125;</span><br><span class="line">                        superClass = superClass.getSuperclass();</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;findChildBySuper end&quot;</span>);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="打印参数">打印参数<a class="header-anchor" href="#打印参数"> ¶ </a></h3>
<h4 id="加载dex使用gson打印">加载dex使用gson打印<a class="header-anchor" href="#加载dex使用gson打印"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">Java.openClassFile(<span class="string">&quot;xxx.dex&quot;</span>).load();</span><br><span class="line"></span><br><span class="line"><span class="comment">// 示例</span></span><br><span class="line">Java.openClassFile(<span class="string">&quot;/data/local/tmp/r0gson.dex&quot;</span>).load();</span><br><span class="line"><span class="keyword">const</span> gson = Java.use(<span class="string">&#x27;com.r0ysue.gson.Gson&#x27;</span>);</span><br><span class="line">gson.$new().toJson( object );</span><br></pre></td></tr></table></figure>
<h4 id="查看类与类型强转">查看类与类型强转<a class="header-anchor" href="#查看类与类型强转"> ¶ </a></h4>
<p>对于hook时，找不到相关属性（Frida不清楚类型的），可以使用Cast类型强转来指定类型。</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// 通过反射查看当前实例类型（所属类）</span></span><br><span class="line">.getClass().getName().toString()</span><br><span class="line"></span><br><span class="line"><span class="comment">// 子类强制转换父类</span></span><br><span class="line">Java.cast()</span><br><span class="line"><span class="keyword">var</span> WaterHandle = Java.cast(JuiceHandle,Java.use(<span class="string">&quot;com.r0ysue.a0526printout.Water&quot;</span>))</span><br><span class="line"></span><br><span class="line"><span class="comment">/** 父类不能强制转换子类 **/</span></span><br></pre></td></tr></table></figure>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment"> * 根据实例对象找到其类名</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">getObjClassName</span>(<span class="params">obj</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">if</span> (!jclazz) &#123;</span><br><span class="line">        <span class="keyword">var</span> jclazz = Java.use(<span class="string">&quot;java.lang.Class&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> (!jobj) &#123;</span><br><span class="line">        <span class="keyword">var</span> jobj = Java.use(<span class="string">&quot;java.lang.Object&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">return</span> jclazz.getName.call(jobj.getClass.call(obj));</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="Array数组">Array数组<a class="header-anchor" href="#Array数组"> ¶ </a></h4>
<h5 id="hook-array数组">hook array数组<a class="header-anchor" href="#hook-array数组"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// char[] [C</span></span><br><span class="line">Java.use(<span class="string">&quot;java.util.Arrays&quot;</span>).toString.overload(<span class="string">&#x27;[C&#x27;</span>).implementation = <span class="function"><span class="keyword">function</span>(<span class="params">charArray</span>)</span>&#123;&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// 同理byte[] 为[B</span></span><br></pre></td></tr></table></figure>
<h5 id="打印-array数组">打印 array数组<a class="header-anchor" href="#打印-array数组"> ¶ </a></h5>
<ol>
<li>使用gson打印</li>
<li>使用<code>java.util.Arrays.toString()</code>打印</li>
<li>使用<code>JSON.stringify()</code>打印</li>
<li>遍历
<ol>
<li>如果Frida直接打印可以显示为数组，可通过<code>.length</code>属性进行for循环遍历</li>
<li>复杂类型的，如Frida直接打印显示为<code>[[C</code>、<code>[B</code>的，可以使用Java的<code>Array</code>类。<code>Array.getLength()</code>获得长度、<code>Array.get()</code>获得对应元素，<code>Array.getChar()</code>获得char元素</li>
</ol>
</li>
</ol>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// Hook Arrays.toString方法 重载char[]</span></span><br><span class="line">        Java.use(<span class="string">&quot;java.util.Arrays&quot;</span>).toString.overload(<span class="string">&quot;[C&quot;</span>).implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="comment">// 打印参数</span></span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;arg = &quot;</span>, <span class="built_in">arguments</span>[<span class="number">0</span>]);</span><br><span class="line">            <span class="comment">// 可正确打印方法1</span></span><br><span class="line">            <span class="comment">// console.log(&quot;arg = &quot;, this.toString(arguments[0]));</span></span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;arg = &quot;</span>, Java.use(<span class="string">&quot;java.util.Arrays&quot;</span>).toString(<span class="built_in">arguments</span>[<span class="number">0</span>]));</span><br><span class="line">            <span class="comment">// 可正确打印方法2</span></span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;arg = &quot;</span>, <span class="built_in">JSON</span>.stringify(<span class="built_in">arguments</span>[<span class="number">0</span>]));</span><br><span class="line">            <span class="comment">/* 手动构造一个Java array：参数一为类型，参数二为数组 */</span></span><br><span class="line">            <span class="keyword">var</span> arg = Java.array(<span class="string">&quot;char&quot;</span>, [<span class="string">&quot;上&quot;</span>, <span class="string">&quot;山&quot;</span>, <span class="string">&quot;打&quot;</span>, <span class="string">&quot;老&quot;</span>, <span class="string">&quot;虎&quot;</span>]);</span><br><span class="line">            <span class="keyword">var</span> result = <span class="built_in">this</span>.toString(arg);</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;[NEW]arg,result = &quot;</span>, arg, result);</span><br><span class="line">            <span class="keyword">return</span> result;</span><br><span class="line">        &#125;;</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h5 id="byte-打印">byte[]打印<a class="header-anchor" href="#byte-打印"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">var</span> ByteString = Java.use(<span class="string">&quot;com.android.okhttp.okio.ByteString&quot;</span>);</span><br><span class="line"><span class="built_in">console</span>.log(ByteString.of(result).hex());</span><br></pre></td></tr></table></figure>
<p>或者使用<a href="#%E6%A0%BC%E5%BC%8F%E5%8C%96%E6%89%93%E5%8D%B0%E5%8D%81%E5%85%AD%E8%BF%9B%E5%88%B6%E6%95%B0%E6%8D%AE">格式化打印十六进制数据</a></p>
<h4 id="枚举">枚举<a class="header-anchor" href="#枚举"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.choose(<span class="string">&quot;com.forgotten.fridatestapp.construct.ConstructoredObject&quot;</span>, &#123;</span><br><span class="line">        <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">instance</span>) </span>&#123;</span><br><span class="line">            <span class="comment">// 找到后获取实例field map的值，尝试转为自定义Enum Signal类型</span></span><br><span class="line">            <span class="keyword">var</span> venum = Java.cast(instance.color.value, Java.use(<span class="string">&quot;com.forgotten.fridatestapp.construct.ConstructoredObject$Signal&quot;</span>));</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;venum:&quot;</span>, venum);</span><br><span class="line">            <span class="comment">// 调用Enum的方法</span></span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;venum.name():&quot;</span>, venum.name());</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;venum.ordinal():&quot;</span>, venum.ordinal());</span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;venum: search completed&quot;</span>);</span><br><span class="line">        &#125;,</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;);</span><br></pre></td></tr></table></figure>
<h4 id="HashMap类型">HashMap类型<a class="header-anchor" href="#HashMap类型"> ¶ </a></h4>
<p>使用iterator迭代打印</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 在内存中查找ConstructoredObject类的实例</span></span><br><span class="line">        Java.choose(<span class="string">&quot;com.forgotten.fridatestapp.construct.ConstructoredObject&quot;</span>, &#123;</span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">instance</span>) </span>&#123;</span><br><span class="line">                <span class="comment">// 找到后获取实例field map的值，尝试转为HashMap类型</span></span><br><span class="line">                <span class="keyword">var</span> vmap = Java.cast(instance.map.value, Java.use(<span class="string">&quot;java.util.HashMap&quot;</span>));</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;vmap:&quot;</span>, vmap);</span><br><span class="line">                <span class="comment">// 1.</span></span><br><span class="line">                <span class="keyword">var</span> key_iterator = vmap.keySet().iterator();</span><br><span class="line">                <span class="keyword">while</span> (key_iterator.hasNext()) &#123;</span><br><span class="line">                    <span class="keyword">var</span> key = key_iterator.next().toString();</span><br><span class="line">                    <span class="keyword">var</span> value = vmap.get(key).toString();</span><br><span class="line">                    <span class="built_in">console</span>.log(key + <span class="string">&quot;: &quot;</span> + value);</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">// 2.</span></span><br><span class="line">                <span class="keyword">var</span> entry_iterator = vmap.entrySet().iterator();</span><br><span class="line">                <span class="keyword">while</span> (entry_iterator.hasNext()) &#123;</span><br><span class="line">                    <span class="keyword">var</span> entry = Java.cast(entry_iterator.next(),Java.use(<span class="string">&quot;java.util.HashMap$Node&quot;</span>));</span><br><span class="line">                    <span class="built_in">console</span>.log(<span class="string">&quot;entry&quot;</span>, entry);</span><br><span class="line">                    <span class="built_in">console</span>.log(entry.getKey(), entry.getValue());</span><br><span class="line">                &#125;</span><br><span class="line">                <span class="comment">// 3.</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;vmap.toString():&quot;</span>, vmap.toString());</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;vmap: search completed&quot;</span>);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h3 id="构造参数">构造参数<a class="header-anchor" href="#构造参数"> ¶ </a></h3>
<h4 id="构造Object">构造Object[]<a class="header-anchor" href="#构造Object"> ¶ </a></h4>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">result = Java.array(<span class="string">&quot;Ljava.lang.Object;&quot;</span>,[Java.use(<span class="string">&quot;java.lang.Integer&quot;</span>).$<span class="keyword">new</span>(<span class="number">9</span>),Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$<span class="keyword">new</span>(<span class="string">&quot;nihao&quot;</span>)])</span><br></pre></td></tr></table></figure>
<h5 id="构造-array数组">构造 array数组<a class="header-anchor" href="#构造-array数组"> ¶ </a></h5>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// 构造char[]数组</span></span><br><span class="line">Java.array(<span class="string">&#x27;char&#x27;</span>, [ <span class="string">&#x27;烟&#x27;</span>,<span class="string">&#x27;村&#x27;</span>,<span class="string">&#x27;四&#x27;</span>,<span class="string">&#x27;五&#x27;</span>,<span class="string">&#x27;家&#x27;</span>]);</span><br><span class="line"></span><br><span class="line"><span class="comment">// 构造String[]数组</span></span><br><span class="line">Java.array(<span class="string">&#x27;java.lang.String&#x27;</span>, [ <span class="string">&#x27;烟&#x27;</span>,<span class="string">&#x27;村&#x27;</span>,<span class="string">&#x27;四&#x27;</span>,<span class="string">&#x27;五&#x27;</span>,<span class="string">&#x27;家&#x27;</span>]);</span><br></pre></td></tr></table></figure>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> string1 = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;123&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> string2 = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;&quot;</span>);</span><br><span class="line">        <span class="comment">// var strarr = Java.array(&quot;java.lang.String&quot;, [string1, string2]);</span></span><br><span class="line">        </span><br><span class="line">        <span class="comment">// 创建String数组，并添加值</span></span><br><span class="line">        <span class="keyword">var</span> Ref_arr = Java.use(<span class="string">&quot;java.lang.reflect.Array&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> stringClass = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).class;</span><br><span class="line">        <span class="keyword">var</span> arr = Ref_arr.newInstance(stringClass, <span class="number">2</span>);</span><br><span class="line">        Ref_arr.set(arr, <span class="number">0</span>, string1);</span><br><span class="line">        Ref_arr.set(arr, <span class="number">1</span>, string2);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">var</span> obj1 = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;24717361&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> obj2 = Java.use(<span class="string">&quot;java.lang.Integer&quot;</span>).$new(<span class="number">19</span>);</span><br><span class="line">        <span class="keyword">var</span> obj3 = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(<span class="string">&quot;&quot;</span>);</span><br><span class="line">        <span class="comment">// 创建Object数组</span></span><br><span class="line">        <span class="keyword">var</span> objarr = Java.array(<span class="string">&quot;java.lang.Object&quot;</span>, [arr, obj1, obj2, obj3]);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="built_in">JSON</span>.stringify(objarr))</span><br><span class="line">        <span class="built_in">console</span>.log(Java.use(<span class="string">&quot;java.util.Arrays&quot;</span>).toString(objarr));</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="Others">Others<a class="header-anchor" href="#Others"> ¶ </a></h3>
<h4 id="Frida构造多线程（新建类）">Frida构造多线程（新建类）<a class="header-anchor" href="#Frida构造多线程（新建类）"> ¶ </a></h4>
<p>新建线程（即实现类时实现Runnable接口）</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">newThread</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> Runnable = Java.use(<span class="string">&quot;java.lang.Runnable&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> Thread = Java.use(<span class="string">&quot;java.lang.Thread&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> MyRunnable = Java.registerClass(&#123;</span><br><span class="line">            <span class="attr">name</span>: <span class="string">&quot;com.forgotten.thread&quot;</span>,</span><br><span class="line">            <span class="attr">implements</span>: [Runnable],</span><br><span class="line">            <span class="attr">fields</span>: &#123;</span><br><span class="line">                <span class="comment">// 成员变量名，与类型</span></span><br><span class="line">                <span class="attr">num</span>: <span class="string">&quot;int&quot;</span>,</span><br><span class="line">                <span class="attr">str</span>: <span class="string">&quot;java.lang.String&quot;</span></span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">methods</span>: &#123;</span><br><span class="line">                <span class="attr">$init</span>: [</span><br><span class="line">                    &#123;</span><br><span class="line">                        <span class="attr">returnType</span>: <span class="string">&quot;void&quot;</span>,</span><br><span class="line">                        <span class="attr">argumentTypes</span>: [<span class="string">&quot;int&quot;</span>,<span class="string">&quot;java.lang.String&quot;</span>],</span><br><span class="line">                        <span class="attr">implementation</span>: <span class="function"><span class="keyword">function</span> (<span class="params">num,str</span>) </span>&#123;</span><br><span class="line">                            <span class="built_in">this</span>.num.value = num;</span><br><span class="line">                            <span class="built_in">this</span>.str.value = str;</span><br><span class="line">                        &#125;,</span><br><span class="line">                    &#125;,</span><br><span class="line">                ],</span><br><span class="line">                <span class="attr">run</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                    <span class="keyword">var</span> i = <span class="number">0</span>;</span><br><span class="line">                    <span class="keyword">for</span> (i = <span class="number">0</span>; i &lt; <span class="number">10</span>; i++) &#123;</span><br><span class="line">                        <span class="built_in">console</span>.log(<span class="built_in">this</span>.num.value,<span class="built_in">this</span>.str.value);</span><br><span class="line">                        <span class="built_in">this</span>.num.value = <span class="built_in">this</span>.num.value + <span class="number">1</span>;</span><br><span class="line">                        Thread.sleep(<span class="number">5</span>);</span><br><span class="line">                    &#125;</span><br><span class="line">                &#125;,</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line"></span><br><span class="line">        <span class="keyword">var</span> myRunnable = MyRunnable.$new(<span class="number">10</span>,<span class="string">&quot;hello&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> myThread = Thread.$new(myRunnable);</span><br><span class="line">        myThread.start();</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h4 id="获取context">获取context<a class="header-anchor" href="#获取context"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">getContext</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;</span><br><span class="line">        <span class="keyword">var</span> currentApplication = Java.use(<span class="string">&quot;android.app.ActivityThread&quot;</span>).currentApplication();</span><br><span class="line">        <span class="built_in">console</span>.log(currentApplication);</span><br><span class="line">        <span class="keyword">var</span> context = currentApplication.getApplicationContext();</span><br><span class="line">        <span class="built_in">console</span>.log(context);</span><br><span class="line">        <span class="keyword">var</span> packageName = context.getPackageName();</span><br><span class="line">        <span class="built_in">console</span>.log(packageName);</span><br><span class="line">        <span class="built_in">console</span>.log(currentApplication.getPackageName());</span><br><span class="line">    &#125;)</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="强制主线程运行">强制主线程运行<a class="header-anchor" href="#强制主线程运行"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">  <span class="keyword">var</span> Toast = Java.use(<span class="string">&#x27;android.widget.Toast&#x27;</span>);</span><br><span class="line">  <span class="keyword">var</span> currentApplication = Java.use(<span class="string">&#x27;android.app.ActivityThread&#x27;</span>).currentApplication(); </span><br><span class="line">  <span class="keyword">var</span> context = currentApplication.getApplicationContext();</span><br><span class="line"></span><br><span class="line">  Java.scheduleOnMainThread(<span class="function"><span class="keyword">function</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Toast.makeText(context, <span class="string">&quot;Hello World&quot;</span>, Toast.LENGTH_LONG.value).show();</span><br><span class="line">  &#125;)</span><br><span class="line">&#125;)</span><br></pre></td></tr></table></figure>
<h2 id="java层代码模板复用">java层代码模板复用<a class="header-anchor" href="#java层代码模板复用"> ¶ </a></h2>
<h3 id="打印调用栈">打印调用栈<a class="header-anchor" href="#打印调用栈"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">printStack</span>(<span class="params">name</span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> Exception = Java.use(<span class="string">&quot;java.lang.Exception&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> ins = Exception.$new(<span class="string">&quot;Exception&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> straces = ins.getStackTrace();</span><br><span class="line">        <span class="keyword">if</span> (straces != <span class="literal">undefined</span> &amp;&amp; straces != <span class="literal">null</span>) &#123;</span><br><span class="line">            <span class="keyword">var</span> strace = straces.toString();</span><br><span class="line">            <span class="keyword">var</span> replaceStr = strace.replace(<span class="regexp">/,/g</span>, <span class="string">&quot;\n&quot;</span>);</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;=============================&quot;</span> + name + <span class="string">&quot; Stack strat=======================&quot;</span>);</span><br><span class="line">            <span class="built_in">console</span>.log(replaceStr);</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;=============================&quot;</span> + name + <span class="string">&quot; Stack end=======================\r\n&quot;</span>);</span><br><span class="line">            Exception.$dispose();</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">printStack</span>(<span class="params">name</span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> throwable = Java.use(<span class="string">&quot;android.util.Log&quot;</span>).getStackTraceString(Java.use(<span class="string">&quot;java.lang.Throwable&quot;</span>).$new());</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;=============================&quot;</span> + name + <span class="string">&quot; Stack strat=======================&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(throwable);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;=============================&quot;</span> + name + <span class="string">&quot; Stack end=======================\r\n&quot;</span>);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// sample 2</span></span><br><span class="line"><span class="keyword">var</span> exception = Java.use(<span class="string">&quot;android.util.Log&quot;</span>).getStackTraceString(Java.use(<span class="string">&quot;java.lang.Exception&quot;</span>).$new());</span><br><span class="line"><span class="built_in">console</span>.log(exception);</span><br></pre></td></tr></table></figure>
<h3 id="格式化打印十六进制数据">格式化打印十六进制数据<a class="header-anchor" href="#格式化打印十六进制数据"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment"> * 十六进制打印数组</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>array 数组</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>off 偏移</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>len 长度</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">jhexdump</span>(<span class="params">array, off, len</span>) </span>&#123;</span><br><span class="line">    off = off || <span class="number">0</span>;</span><br><span class="line">    len = len || <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">var</span> llen = len == <span class="number">0</span> ? array.length : len;</span><br><span class="line">    <span class="keyword">var</span> ptr = Memory.alloc(llen);</span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; llen; ++i) Memory.writeS8(ptr.add(i), array[i]);</span><br><span class="line">    <span class="comment">//console.log(hexdump(ptr, &#123; offset: off, length: len, header: false, ansi: false &#125;));</span></span><br><span class="line">    <span class="built_in">console</span>.log(hexdump(ptr, &#123; <span class="attr">offset</span>: off == <span class="number">0</span> ? <span class="number">0</span> : off, <span class="attr">length</span>: llen, <span class="attr">header</span>: <span class="literal">false</span>, <span class="attr">ansi</span>: <span class="literal">false</span> &#125;));</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="事件">事件<a class="header-anchor" href="#事件"> ¶ </a></h3>
<h4 id="hook-Toast提示-定位">hook Toast提示 定位<a class="header-anchor" href="#hook-Toast提示-定位"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">hook_toast</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="function"><span class="keyword">function</span> <span class="title">printStack</span>(<span class="params">name</span>) </span>&#123;</span><br><span class="line">        Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            <span class="keyword">var</span> throwable = Java.use(<span class="string">&quot;android.util.Log&quot;</span>).getStackTraceString(Java.use(<span class="string">&quot;java.lang.Throwable&quot;</span>).$new());</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;=============================&quot;</span> + name + <span class="string">&quot; Stack strat=======================&quot;</span>);</span><br><span class="line">            <span class="built_in">console</span>.log(throwable);</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;=============================&quot;</span> + name + <span class="string">&quot; Stack end=======================\r\n&quot;</span>);</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> Toast = Java.use(<span class="string">&quot;android.widget.Toast&quot;</span>);</span><br><span class="line">        Toast.show.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">            printStack(<span class="string">&quot;SHOW Toast&quot;</span>);</span><br><span class="line">            <span class="keyword">return</span> <span class="built_in">this</span>.show();</span><br><span class="line">        &#125;;</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">setImmediate(hook_toast);</span><br></pre></td></tr></table></figure>
<h4 id="hook-findViewById-定位组件">hook findViewById 定位组件<a class="header-anchor" href="#hook-findViewById-定位组件"> ¶ </a></h4>
<h4 id="hook-StartActivity">hook StartActivity<a class="header-anchor" href="#hook-StartActivity"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> Activity = Java.use(<span class="string">&quot;android.app.Activity&quot;</span>);</span><br><span class="line">    <span class="comment">//console.log(Object.getOwnPropertyNames(Activity));</span></span><br><span class="line">    Activity.startActivity.overload(<span class="string">&#x27;android.content.Intent&#x27;</span>).implementation=<span class="function"><span class="keyword">function</span>(<span class="params">p1</span>)</span>&#123;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;Hooking android.app.Activity.startActivity(p1) successfully,p1=&quot;</span>+p1);</span><br><span class="line">        <span class="comment">//console.log(Java.use(&quot;android.util.Log&quot;).getStackTraceString(Java.use(&quot;java.lang.Throwable&quot;).$new()));</span></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="built_in">decodeURIComponent</span>(p1.toUri(<span class="number">256</span>)));</span><br><span class="line">        <span class="built_in">this</span>.startActivity(p1);</span><br><span class="line">    &#125;</span><br><span class="line">    Activity.startActivity.overload(<span class="string">&#x27;android.content.Intent&#x27;</span>, <span class="string">&#x27;android.os.Bundle&#x27;</span>).implementation=<span class="function"><span class="keyword">function</span>(<span class="params">p1,p2</span>)</span>&#123;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;Hooking android.app.Activity.startActivity(p1,p2) successfully,p1=&quot;</span>+p1+<span class="string">&quot;,p2=&quot;</span>+p2);</span><br><span class="line">        <span class="comment">//console.log(Java.use(&quot;android.util.Log&quot;).getStackTraceString(Java.use(&quot;java.lang.Throwable&quot;).$new()));</span></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="built_in">decodeURIComponent</span>(p1.toUri(<span class="number">256</span>)));</span><br><span class="line">        <span class="built_in">this</span>.startActivity(p1,p2);</span><br><span class="line">    &#125;</span><br><span class="line">    Activity.startService.overload(<span class="string">&#x27;android.content.Intent&#x27;</span>).implementation=<span class="function"><span class="keyword">function</span>(<span class="params">p1</span>)</span>&#123;</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;Hooking android.app.Activity.startService(p1) successfully,p1=&quot;</span>+p1);</span><br><span class="line">        <span class="comment">//console.log(Java.use(&quot;android.util.Log&quot;).getStackTraceString(Java.use(&quot;java.lang.Throwable&quot;).$new()));</span></span><br><span class="line">        <span class="built_in">console</span>.log(<span class="built_in">decodeURIComponent</span>(p1.toUri(<span class="number">256</span>)));</span><br><span class="line">        <span class="built_in">this</span>.startService(p1);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;)</span><br></pre></td></tr></table></figure>
<h4 id="hook-onClick事件-定位">hook onClick事件 定位<a class="header-anchor" href="#hook-onClick事件-定位"> ¶ </a></h4>
<script src="https://gist.github.com/Forgo7ten/cc325b0c1158babe6c9326e18c4860b3.js"></script>
<h3 id="hook-Keystore：客户端证书校验">hook Keystore：客户端证书校验<a class="header-anchor" href="#hook-Keystore：客户端证书校验"> ¶ </a></h3>
<script src="https://gist.github.com/Forgo7ten/102d46e2f478ddadec0d2350ac8723e3.js"></script>
<h2 id="Frida-RPC-Remote-procedure-call">Frida RPC(Remote procedure call)<a class="header-anchor" href="#Frida-RPC-Remote-procedure-call"> ¶ </a></h2>
<ul>
<li>
<p>Frida(rpc)开到公网：</p>
<p>通过vps安装NPS来将公网的流量转发到手机相应端口</p>
</li>
<li>
<p>利用<code>flask</code>开启网址服务</p>
<p>利用python <code>flask</code>库，将主动调用函数映射为网址服务，只要访问即可调用app中方法</p>
</li>
</ul>
<h3 id="RPC主动调用">RPC主动调用<a class="header-anchor" href="#RPC主动调用"> ¶ </a></h3>
<p><strong>rpc.exports导出名不可以有大写字母或者下划线</strong></p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">invoke</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 搜索HookedObject类实例</span></span><br><span class="line">        Java.choose(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>, &#123;</span><br><span class="line">            <span class="attr">onMatch</span>: <span class="function"><span class="keyword">function</span> (<span class="params">instance</span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;found HookedObject:&quot;</span>, instance);</span><br><span class="line">                <span class="comment">// 查找到实例后主动调用方法</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;ho.getPasswd():&quot;</span>, instance.getPasswd(<span class="string">&quot;123 ABC&quot;</span>));</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="attr">onComplete</span>: <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;HookedObject: search complete.&quot;</span>);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">/* 测试函数 */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">test</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="built_in">console</span>.log(<span class="string">&quot;I&#x27;m Frida_rpc.js!&quot;</span>);</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">/* 导出函数列表(可供py调用的) py函数映射和实际函数名 */</span></span><br><span class="line">rpc.exports = &#123;</span><br><span class="line">    <span class="attr">invokefunc</span>: invoke,</span><br><span class="line">    <span class="attr">testfunc</span>: test,</span><br><span class="line">&#125;;</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> time</span><br><span class="line"><span class="keyword">import</span> frida</span><br><span class="line"></span><br><span class="line"><span class="comment">## handler | script脚本信息交互函数</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">my_message_handler</span>(<span class="params">message,payload</span>):</span></span><br><span class="line">    <span class="built_in">print</span>(message)</span><br><span class="line">    <span class="built_in">print</span>(payload)</span><br><span class="line"></span><br><span class="line"><span class="comment"># 通过Usb连接设备</span></span><br><span class="line"><span class="comment"># device = frida.get_usb_device()</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 通过ip:port 连接设备</span></span><br><span class="line">device = frida.get_device_manager().add_remote_device(<span class="string">&quot;192.168.0.104:8888&quot;</span>)</span><br><span class="line"><span class="comment">################ 通过spawn方式启动 ###########################</span></span><br><span class="line">pid = device.spawn([<span class="string">&quot;com.forgotten.fridatestapp&quot;</span>])</span><br><span class="line">device.resume(pid)</span><br><span class="line">time.sleep(<span class="number">1</span>)</span><br><span class="line">session = device.attach(pid)</span><br><span class="line"><span class="comment">##### &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;</span></span><br><span class="line"><span class="comment"># session = device.attach(&quot;com.forgotten.fridatestapp&quot;)</span></span><br><span class="line"><span class="comment">################ 通过attach现有进程方式启动 ###################</span></span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;./frida_rpc.js&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">    <span class="comment"># 创建一个新脚本</span></span><br><span class="line">    script = session.create_script(f.read())</span><br><span class="line"><span class="comment"># 加载信息交互handler函数</span></span><br><span class="line">script.on(<span class="string">&quot;message&quot;</span>,my_message_handler)</span><br><span class="line"><span class="comment"># 加载脚本</span></span><br><span class="line">script.load()</span><br><span class="line"></span><br><span class="line">command = <span class="string">&quot;&quot;</span></span><br><span class="line"><span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">    command = <span class="built_in">input</span>(<span class="string">&quot;Enter Command(y/t/n): &quot;</span>)</span><br><span class="line">    <span class="keyword">if</span> command==<span class="string">&quot;y&quot;</span>:</span><br><span class="line">        script.exports.invokefunc()</span><br><span class="line">    <span class="keyword">elif</span> command==<span class="string">&quot;t&quot;</span>:</span><br><span class="line">        script.exports.testfunc()</span><br><span class="line">    <span class="keyword">elif</span> command==<span class="string">&quot;n&quot;</span>:</span><br><span class="line">        <span class="keyword">break</span></span><br></pre></td></tr></table></figure>
<h3 id="rpc动态修改">rpc动态修改<a class="header-anchor" href="#rpc动态修改"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">    Java.use(<span class="string">&quot;com.forgotten.fridatestapp.HookedObject&quot;</span>).getPasswd.implementation = <span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 需要发送给python的字符串：由函数的参数和结果拼接而成</span></span><br><span class="line">        <span class="keyword">var</span> string_to_send = <span class="built_in">arguments</span>[<span class="number">0</span>] + <span class="string">&quot;:&quot;</span> + <span class="built_in">this</span>.getPasswd(<span class="built_in">arguments</span>[<span class="number">0</span>]);</span><br><span class="line">        <span class="keyword">var</span> string_to_recv;</span><br><span class="line">        <span class="comment">// 发送到python程序</span></span><br><span class="line">        send(string_to_send);</span><br><span class="line">        <span class="comment">// 同时调用.wait()来 阻塞运行，等待接收消息</span></span><br><span class="line">        recv(<span class="function"><span class="keyword">function</span> (<span class="params">received_json_objection</span>) </span>&#123;</span><br><span class="line">            <span class="comment">// 接收来的json字符串</span></span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;recv in js:&quot;</span>,<span class="built_in">JSON</span>.stringify(received_json_objection))</span><br><span class="line">            <span class="comment">// 打印json的`my_data`,json串来自python</span></span><br><span class="line">            string_to_recv = received_json_objection.my_data;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;string_to_recv:&quot;</span>, string_to_recv);</span><br><span class="line">        &#125;).wait();</span><br><span class="line">        <span class="comment">// 将接收到的字符串当作被hook函数的结果返回回去</span></span><br><span class="line">        <span class="keyword">var</span> result = Java.use(<span class="string">&quot;java.lang.String&quot;</span>).$new(string_to_recv);</span><br><span class="line">        <span class="keyword">return</span> result;</span><br><span class="line">    &#125;;</span><br><span class="line">&#125;);</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> time</span><br><span class="line"><span class="keyword">import</span> frida</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">## handler | script脚本信息交互函数</span></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">my_message_handler</span>(<span class="params">message, payload</span>):</span></span><br><span class="line">    <span class="built_in">print</span>(message)  <span class="comment"># 打印得到的信息</span></span><br><span class="line">    <span class="built_in">print</span>(payload)  <span class="comment"># 输出的为`none`?</span></span><br><span class="line">    <span class="comment"># 如果`type`字段为&quot;send&quot; 则是js发来的消息</span></span><br><span class="line">    <span class="keyword">if</span> message[<span class="string">&quot;type&quot;</span>] == <span class="string">&quot;send&quot;</span>:</span><br><span class="line">        <span class="comment"># 打印json的`payload`内容(js发送过来的内容)</span></span><br><span class="line">        <span class="built_in">print</span>(message[<span class="string">&quot;payload&quot;</span>])</span><br><span class="line">        <span class="comment"># 向script发送消息，格式为字典</span></span><br><span class="line">        script.post(&#123;<span class="string">&quot;my_data&quot;</span>: <span class="string">&quot;Hello&quot;</span>&#125;)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment"># 通过Usb连接设备</span></span><br><span class="line"><span class="comment"># device = frida.get_usb_device()</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 通过ip:port 连接设备</span></span><br><span class="line">device = frida.get_device_manager().add_remote_device(<span class="string">&quot;192.168.0.104:8888&quot;</span>)</span><br><span class="line"><span class="comment">################ 通过spawn方式启动 ###########################</span></span><br><span class="line">pid = device.spawn([<span class="string">&quot;com.forgotten.fridatestapp&quot;</span>])</span><br><span class="line">device.resume(pid)</span><br><span class="line">time.sleep(<span class="number">1</span>)</span><br><span class="line">session = device.attach(pid)</span><br><span class="line"><span class="comment">##### &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;</span></span><br><span class="line"><span class="comment"># session = device.attach(&quot;com.forgotten.fridatestapp&quot;)</span></span><br><span class="line"><span class="comment">################ 通过attach现有进程方式启动 ###################</span></span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;./frida_rpc.js&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">    <span class="comment"># 创建一个新脚本</span></span><br><span class="line">    script = session.create_script(f.read())</span><br><span class="line"><span class="comment"># 加载信息交互handler函数</span></span><br><span class="line">script.on(<span class="string">&quot;message&quot;</span>, my_message_handler)</span><br><span class="line"><span class="comment"># 加载脚本</span></span><br><span class="line">script.load()</span><br><span class="line"></span><br><span class="line">command = <span class="string">&quot;&quot;</span></span><br><span class="line"><span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">    command = <span class="built_in">input</span>(<span class="string">&quot;Enter `n` for leave: &quot;</span>)</span><br><span class="line">    <span class="keyword">if</span> command == <span class="string">&quot;n&quot;</span>:</span><br><span class="line">        <span class="keyword">break</span></span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h3 id="More">More<a class="header-anchor" href="#More"> ¶ </a></h3>
<p><a target="_blank" rel="noopener" href="https://github.com/frida/frida-python/tree/main/examples">frida-python/examples at main · frida/frida-python (github.com)</a></p>
<h2 id="Frida-native层应用">Frida native层应用<a class="header-anchor" href="#Frida-native层应用"> ¶ </a></h2>
<p>Frida实现的Env：<a target="_blank" rel="noopener" href="https://github.com/frida/frida-java-bridge/blob/main/lib/env.js">frida-java-bridge/env.js at main · frida/frida-java-bridge (github.com)</a></p>
<h3 id="判断Thumb-OR-arm">判断Thumb OR arm<a class="header-anchor" href="#判断Thumb-OR-arm"> ¶ </a></h3>
<p>判断Thumb OR arm模式：</p>
<ul>
<li>IDA查看指令机器码长度，都为4字节为arm指令</li>
<li><code>push</code>指令为thumb指令特有</li>
</ul>
<h3 id="hook用户函数">hook用户函数<a class="header-anchor" href="#hook用户函数"> ¶ </a></h3>
<h4 id="attach静态注册-或导出-函数">attach静态注册(或导出)函数<a class="header-anchor" href="#attach静态注册-或导出-函数"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main0</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="comment">/* hook 可导出的native函数 */</span></span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> (<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 寻找模块so的地址</span></span><br><span class="line">        <span class="keyword">var</span> lib_fridatestapp_addr = Module.findBaseAddress(<span class="string">&quot;libfridatestapp.so&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;native_lib_addr -&gt; &quot;</span>, lib_fridatestapp_addr);</span><br><span class="line">        <span class="comment">// 寻找导出函数的地址</span></span><br><span class="line">        <span class="keyword">var</span> staticString_addr = Module.findExportByName(<span class="string">&quot;libfridatestapp.so&quot;</span>, <span class="string">&quot;Java_com_forgotten_fridatestapp_MainActivity_staticString&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;staticString() addr -&gt; &quot;</span>, staticString_addr);</span><br><span class="line">        <span class="comment">// 对函数进行attach</span></span><br><span class="line">        Interceptor.attach(staticString_addr, &#123;</span><br><span class="line">            <span class="comment">// 函数进入时，参数为函数的参数</span></span><br><span class="line">            <span class="attr">onEnter</span>: <span class="function"><span class="keyword">function</span> (<span class="params">args</span>) </span>&#123;</span><br><span class="line">                <span class="comment">/* 打印native函数调用栈，有Backtracer.ACCURATE和Backtracer.FUZZY两种模式切换 */</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;CCCryptorCreate called from:\n&quot;</span> + Thread.backtrace(<span class="built_in">this</span>.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join(<span class="string">&quot;\n&quot;</span>) + <span class="string">&quot;\n&quot;</span>);</span><br><span class="line"></span><br><span class="line">                <span class="comment">// 打印三个参数地址</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Interceptor.attach staticString() args:&quot;</span>, args[<span class="number">0</span>], args[<span class="number">1</span>], args[<span class="number">2</span>]);</span><br><span class="line">                <span class="comment">// 将 参数三传进去的jstring字符串，转换为char*再用readCString()得到JavaScript字符串来输出</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;jstring is&quot;</span>, Java.vm.getEnv().getStringUtfChars(args[<span class="number">2</span>], <span class="literal">null</span>).readCString());</span><br><span class="line"></span><br><span class="line">                <span class="comment">// 可以对参数进行修改</span></span><br><span class="line">                <span class="keyword">var</span> new_arg2 = Java.vm.getEnv().newStringUtf(<span class="string">&quot;new arg2 from Frida&quot;</span>);</span><br><span class="line">                args[<span class="number">2</span>] = new_arg2;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="comment">// 函数执行完的时候，参数为函数的返回值</span></span><br><span class="line">            <span class="attr">onLeave</span>: <span class="function"><span class="keyword">function</span> (<span class="params">reval</span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Interceptor.attach staticString() retval&quot;</span>, reval);</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Interceptor.attach staticString() retval&quot;</span>, Java.vm.getEnv().getStringUtfChars(reval, <span class="literal">null</span>).readCString());</span><br><span class="line"></span><br><span class="line">                <span class="comment">// 对函数的返回值进行替换</span></span><br><span class="line">                <span class="keyword">var</span> new_reval = Java.vm.getEnv().newStringUtf(<span class="string">&quot;HaHa Frida!!!&quot;</span>);</span><br><span class="line">                reval.replace(new_reval);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="主动调用静态注册-或导出-函数">主动调用静态注册(或导出)函数<a class="header-anchor" href="#主动调用静态注册-或导出-函数"> ¶ </a></h4>
<p>注册native函数：<code>new NativeFunction(address, returnType, argTypes[, abi])</code></p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main1</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="comment">/* 主动调用 可导出的native函数 */</span></span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> <span class="title">invoke_justAdd_func</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 寻找模块so的地址</span></span><br><span class="line">        <span class="keyword">var</span> lib_fridatestapp_addr = Module.findBaseAddress(<span class="string">&quot;libfridatestapp.so&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;native_lib_addr -&gt; &quot;</span>, lib_fridatestapp_addr);</span><br><span class="line">        <span class="comment">// 寻找导出函数的地址</span></span><br><span class="line">        <span class="keyword">var</span> justAdd_addr = Module.findExportByName(<span class="string">&quot;libfridatestapp.so&quot;</span>, <span class="string">&quot;_Z7justAddii&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;justAdd() addr -&gt; &quot;</span>, justAdd_addr);</span><br><span class="line">        <span class="comment">// 新建一个Native函数，参数分别为 已存在函数地址，函数返回值类型，函数参数列表</span></span><br><span class="line">        <span class="keyword">var</span> justAdd_func = <span class="keyword">new</span> NativeFunction(justAdd_addr, <span class="string">&quot;int&quot;</span>, [<span class="string">&quot;int&quot;</span>, <span class="string">&quot;int&quot;</span>]);</span><br><span class="line">        <span class="comment">// 执行函数，获得函数返回值</span></span><br><span class="line">        <span class="keyword">var</span> justAdd_result = justAdd_func(<span class="number">10</span>, <span class="number">2</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;invoke justAdd(10,2) result-&gt; &quot;</span>, justAdd_result);</span><br><span class="line">    &#125;);</span><br><span class="line"></span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> <span class="title">invoke_nativeString_func</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">/* 大部分代码同 hook函数中的 */</span></span><br><span class="line">        <span class="comment">// 寻找模块so的地址</span></span><br><span class="line">        <span class="keyword">var</span> lib_fridatestapp_addr = Module.findBaseAddress(<span class="string">&quot;libfridatestapp.so&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;native_lib_addr -&gt; &quot;</span>, lib_fridatestapp_addr);</span><br><span class="line">        <span class="comment">// 寻找导出函数的地址</span></span><br><span class="line">        <span class="keyword">var</span> staticString_addr = Module.findExportByName(<span class="string">&quot;libfridatestapp.so&quot;</span>, <span class="string">&quot;Java_com_forgotten_fridatestapp_MainActivity_staticString&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;staticString() addr -&gt; &quot;</span>, staticString_addr);</span><br><span class="line"></span><br><span class="line">        <span class="comment">/* 声明该native函数，返回值和参数env、jobject等都是&quot;pointer&quot; */</span></span><br><span class="line">        <span class="keyword">var</span> nativeString_func = <span class="keyword">new</span> NativeFunction(staticString_addr, <span class="string">&quot;pointer&quot;</span>, [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line"></span><br><span class="line">        <span class="comment">// 对函数进行attach</span></span><br><span class="line">        Interceptor.attach(staticString_addr, &#123;</span><br><span class="line">            <span class="comment">// 函数进入时，参数为函数的参数</span></span><br><span class="line">            <span class="attr">onEnter</span>: <span class="function"><span class="keyword">function</span> (<span class="params">args</span>) </span>&#123;</span><br><span class="line">                <span class="comment">// 打印三个参数地址</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Interceptor.attach staticString() args:&quot;</span>, args[<span class="number">0</span>], args[<span class="number">1</span>], args[<span class="number">2</span>]);</span><br><span class="line">                <span class="comment">// 将 参数三传进去的jstring字符串，转换为char*再用readCString()得到JavaScript字符串来输出</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;jstring is&quot;</span>, Java.vm.getEnv().getStringUtfChars(args[<span class="number">2</span>], <span class="literal">null</span>).readCString());</span><br><span class="line"></span><br><span class="line">                <span class="comment">/* 主动调用方法，打印函数结果 */</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;==&gt; invoke stringfunc(): &quot;</span>, Java.vm.getEnv().getStringUtfChars(nativeString_func(args[<span class="number">0</span>], args[<span class="number">1</span>], args[<span class="number">2</span>]), <span class="literal">null</span>).readCString());</span><br><span class="line"></span><br><span class="line">                <span class="comment">// 可以对参数进行修改</span></span><br><span class="line">                <span class="keyword">var</span> new_arg2 = Java.vm.getEnv().newStringUtf(<span class="string">&quot;new arg2 from Frida&quot;</span>);</span><br><span class="line">                args[<span class="number">2</span>] = new_arg2;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="comment">// 函数执行完的时候，参数为函数的返回值</span></span><br><span class="line">            <span class="attr">onLeave</span>: <span class="function"><span class="keyword">function</span> (<span class="params">reval</span>) </span>&#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Interceptor.attach staticString() retval&quot;</span>, reval);</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;Interceptor.attach staticString() retval&quot;</span>, Java.vm.getEnv().getStringUtfChars(reval, <span class="literal">null</span>).readCString());</span><br><span class="line"></span><br><span class="line">                <span class="comment">// 对函数的返回值进行替换</span></span><br><span class="line">                <span class="keyword">var</span> new_reval = Java.vm.getEnv().newStringUtf(<span class="string">&quot;HaHa Frida!!!&quot;</span>);</span><br><span class="line">                reval.replace(new_reval);</span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="replace静态注册-或导出-函数">replace静态注册(或导出)函数<a class="header-anchor" href="#replace静态注册-或导出-函数"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main2</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="comment">/* 替换 justAdd函数 */</span></span><br><span class="line">    Java.perform(<span class="function"><span class="keyword">function</span> <span class="title">replace_func</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">        <span class="comment">// 寻找模块so的地址</span></span><br><span class="line">        <span class="keyword">var</span> lib_fridatestapp_addr = Module.findBaseAddress(<span class="string">&quot;libfridatestapp.so&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;native_lib_addr -&gt; &quot;</span>, lib_fridatestapp_addr);</span><br><span class="line">        <span class="comment">// 寻找导出函数的地址</span></span><br><span class="line">        <span class="keyword">var</span> justAdd_addr = Module.findExportByName(<span class="string">&quot;libfridatestapp.so&quot;</span>, <span class="string">&quot;_Z7justAddii&quot;</span>);</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;justAdd() addr -&gt; &quot;</span>, justAdd_addr);</span><br><span class="line">        <span class="comment">// 对原native函数进行替换，参数1为替换的地址，参数2为一个NativeCallback</span></span><br><span class="line">        Interceptor.replace(</span><br><span class="line">            justAdd_addr,</span><br><span class="line">            <span class="keyword">new</span> NativeCallback(</span><br><span class="line">                <span class="comment">// 参数分别为，替换执行的函数，返回值类型，参数类型列表</span></span><br><span class="line">                <span class="function"><span class="keyword">function</span> (<span class="params">a, b</span>) </span>&#123;</span><br><span class="line">                    <span class="built_in">console</span>.log(<span class="string">&quot;justAdd args: &quot;</span>, a, b);</span><br><span class="line">                    <span class="keyword">var</span> result = a * (b + <span class="number">5</span>);</span><br><span class="line">                    <span class="built_in">console</span>.log(<span class="string">&quot;new Func Result: &quot;</span>, result);</span><br><span class="line">                    <span class="keyword">return</span> result;</span><br><span class="line">                &#125;,</span><br><span class="line">                <span class="string">&quot;int&quot;</span>,</span><br><span class="line">                [<span class="string">&quot;int&quot;</span>, <span class="string">&quot;int&quot;</span>]</span><br><span class="line">            )</span><br><span class="line">        );</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="通过地址偏移操作未导出函数">通过地址偏移操作未导出函数<a class="header-anchor" href="#通过地址偏移操作未导出函数"> ¶ </a></h4>
<p>通过ida找到函数偏移</p>
<figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">function <span class="title">main3</span><span class="params">()</span> </span>&#123;</span><br><span class="line">    <span class="comment">/* 靠地址偏移hook未导出函数  */</span></span><br><span class="line">    Java.perform(function () &#123;</span><br><span class="line">        <span class="comment">// 寻找模块so的地址</span></span><br><span class="line">        <span class="keyword">var</span> lib_fridatestapp_addr = Module.findBaseAddress(<span class="string">&quot;libfridatestapp.so&quot;</span>);</span><br><span class="line">        console.log(<span class="string">&quot;native_lib_addr -&gt; &quot;</span>, lib_fridatestapp_addr);</span><br><span class="line">        <span class="comment">// 通过函数偏移+模块的地址，得到函数的地址</span></span><br><span class="line">        <span class="keyword">var</span> dynamicString_addr = lib_fridatestapp_addr.add(<span class="number">0xa48</span>);</span><br><span class="line">        console.log(<span class="string">&quot;dynamicString() addr -&gt; &quot;</span>, dynamicString_addr);</span><br><span class="line">        <span class="comment">// 对函数进行attach</span></span><br><span class="line">        Interceptor.attach(dynamicString_addr, &#123;</span><br><span class="line">            <span class="comment">// 函数进入时，参数为函数的参数</span></span><br><span class="line">            onEnter: function (args) &#123;</span><br><span class="line">                <span class="comment">/* 打印native函数调用栈，有Backtracer.ACCURATE和Backtracer.FUZZY两种模式切换 */</span></span><br><span class="line">                <span class="comment">// console.log(&quot;CCCryptorCreate called from:\n&quot; + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join(&quot;\n&quot;) + &quot;\n&quot;);</span></span><br><span class="line"></span><br><span class="line">                <span class="comment">// 打印三个参数地址</span></span><br><span class="line">                console.log(<span class="string">&quot;Interceptor.attach dynamicString() args:&quot;</span>, args[<span class="number">0</span>], args[<span class="number">1</span>], args[<span class="number">2</span>]);</span><br><span class="line">                <span class="comment">// 将 参数三传进去的jstring字符串，转换为char*再用readCString()得到JavaScript字符串来输出</span></span><br><span class="line">                <span class="comment">// console.log(&quot;jstring is&quot;, Java.vm.getEnv().getStringUtfChars(args[2], null).readCString());</span></span><br><span class="line"></span><br><span class="line">                <span class="comment">// 可以对参数进行修改</span></span><br><span class="line">                <span class="keyword">var</span> new_arg2 = Java.vm.getEnv().newStringUtf(<span class="string">&quot;new arg2 from Frida&quot;</span>);</span><br><span class="line">                args[<span class="number">2</span>] = new_arg2;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="comment">// 函数执行完的时候，参数为函数的返回值</span></span><br><span class="line">            onLeave: function (reval) &#123;</span><br><span class="line">                console.log(<span class="string">&quot;Interceptor.attach dynamicString() retval&quot;</span>, reval);</span><br><span class="line">                console.log(<span class="string">&quot;Interceptor.attach dynamicString() retval&quot;</span>, Java.vm.getEnv().getStringUtfChars(reval, <span class="keyword">null</span>).readCString());</span><br><span class="line"></span><br><span class="line">                <span class="comment">// 对函数的返回值进行替换</span></span><br><span class="line">                <span class="keyword">var</span> new_reval = Java.vm.getEnv().newStringUtf(<span class="string">&quot;HaHa Frida!!!&quot;</span>);</span><br><span class="line">                <span class="comment">// reval.replace(new_reval);</span></span><br><span class="line">            &#125;,</span><br><span class="line">        &#125;);</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="模块相关操作">模块相关操作<a class="header-anchor" href="#模块相关操作"> ¶ </a></h3>
<h4 id="枚举出所有模块的所有导出符号">枚举出所有模块的所有导出符号<a class="header-anchor" href="#枚举出所有模块的所有导出符号"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/* 枚举出所有模块的所有导出符号 */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">EnumerateAllExports</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> modules = Process.enumerateModules();</span><br><span class="line">    <span class="comment">//print all modules</span></span><br><span class="line">    <span class="comment">//console.log(&quot;Process.enumerateModules-&gt;&quot;,JSON.stringify(modules));</span></span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; modules.length; i++) &#123;</span><br><span class="line">        <span class="keyword">var</span> <span class="built_in">module</span> = modules[i];</span><br><span class="line">        <span class="keyword">var</span> module_name = modules[i].name;</span><br><span class="line">        <span class="keyword">var</span> <span class="built_in">exports</span> = <span class="built_in">module</span>.enumerateExports();</span><br><span class="line">        <span class="built_in">console</span>.log(<span class="string">&quot;module.enumerateeExports&quot;</span>, <span class="built_in">JSON</span>.stringify(<span class="built_in">exports</span>));</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="遍历某模块符号-导出-导入">遍历某模块符号/导出/导入<a class="header-anchor" href="#遍历某模块符号-导出-导入"> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">look_module</span>(<span class="params">module_name</span>)</span>&#123;</span><br><span class="line">    <span class="comment">// 根据模块名称寻找地址；根据地址找到模块返回Module对象</span></span><br><span class="line">    <span class="keyword">var</span> native_lib_addr = Process.findModuleByAddress(Module.findBaseAddress(module_name));</span><br><span class="line">    <span class="built_in">console</span>.log(<span class="string">&quot;native_lib_addr =&gt; &quot;</span>,<span class="built_in">JSON</span>.stringify(native_lib_addr));</span><br><span class="line">    <span class="comment">// 遍历模块的所有Symbols</span></span><br><span class="line">    <span class="built_in">console</span>.log(<span class="string">&quot;enumerateImports=&gt;&quot;</span>,<span class="built_in">JSON</span>.stringify(native_lib_addr.enumerateSymbols()));</span><br><span class="line"></span><br><span class="line">&#125;</span><br><span class="line">look_module(<span class="string">&quot;linker64&quot;</span>);</span><br></pre></td></tr></table></figure>
<h3 id="JNI框架层的利用">JNI框架层的利用<a class="header-anchor" href="#JNI框架层的利用"> ¶ </a></h3>
<h4 id="JNI框架hook：">JNI框架hook：<a class="header-anchor" href="#JNI框架hook："> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/* hook jni函数GetStringUTFChars */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">hook_getStringUTFChars_func</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> GetStringUTFChars_addr = <span class="literal">null</span>;</span><br><span class="line">    <span class="comment">// 该函数在这个so里面，遍历里面的所有符号</span></span><br><span class="line">    <span class="keyword">var</span> symbools = Process.findModuleByName(<span class="string">&quot;libart.so&quot;</span>).enumerateSymbols();</span><br><span class="line">    <span class="comment">//console.log(JSON.stringify(symbool));</span></span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; symbools.length; i++) &#123;</span><br><span class="line">        <span class="comment">// 取到符号的name</span></span><br><span class="line">        <span class="keyword">var</span> symbol = symbools[i].name;</span><br><span class="line">        <span class="comment">// 过滤一下，因为还有一个checkjni类中有该函数</span></span><br><span class="line">        <span class="keyword">if</span> (symbol.indexOf(<span class="string">&quot;CheckJNI&quot;</span>) == -<span class="number">1</span> &amp;&amp; symbol.indexOf(<span class="string">&quot;JNI&quot;</span>) &gt;= <span class="number">0</span>) &#123;</span><br><span class="line">            <span class="keyword">if</span> (symbol.indexOf(<span class="string">&quot;GetStringUTFChars&quot;</span>) &gt;= <span class="number">0</span>) &#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;finally found GetStringUTFChars name:&quot;</span>, symbol);</span><br><span class="line">                <span class="comment">// 保存该函数的地址</span></span><br><span class="line">                GetStringUTFChars_addr = symbools[i].address;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;finally found GetStringUTFChars address :&quot;</span>, GetStringUTFChars_addr);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="comment">/* 开始附加该函数 */</span></span><br><span class="line">    Interceptor.attach(GetStringUTFChars_addr, &#123;</span><br><span class="line">        <span class="attr">onEnter</span>: <span class="function"><span class="keyword">function</span> (<span class="params">args</span>) </span>&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;art::JNI::GetStringUTFChars(_JNIEnv*,_jstring*,unsigned char*)-&gt;&quot;</span>, args[<span class="number">0</span>], Java.vm.getEnv().getStringUtfChars(args[<span class="number">1</span>], <span class="literal">null</span>).readCString(), args[<span class="number">2</span>]);</span><br><span class="line">            <span class="comment">// 打印栈回溯</span></span><br><span class="line">            <span class="comment">// console.log(&quot;CCCryptoCreate called from:\n&quot; + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join(&quot;\n&quot;) + &quot;\n&quot;);</span></span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="attr">onLeave</span>: <span class="function"><span class="keyword">function</span> (<span class="params">retval</span>) </span>&#123;</span><br><span class="line">            <span class="comment">// 打印返回值，为c字符串</span></span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;retval is-&gt;&quot;</span>, retval.readCString());</span><br><span class="line">        &#125;,</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h4 id="JNI框架replace：">JNI框架replace：<a class="header-anchor" href="#JNI框架replace："> ¶ </a></h4>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/* 对NewStringUTF函数进行replace操作 */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">replace_NewStringUTF_func</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="comment">/* 同上 */</span></span><br><span class="line">    <span class="keyword">var</span> NewStringUTF_addr = <span class="literal">null</span>;</span><br><span class="line">    <span class="comment">// 该函数在这个so里面，遍历里面的所有符号</span></span><br><span class="line">    <span class="keyword">var</span> symbools = Process.findModuleByName(<span class="string">&quot;libart.so&quot;</span>).enumerateSymbols();</span><br><span class="line">    <span class="comment">//console.log(JSON.stringify(symbool));</span></span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; symbools.length; i++) &#123;</span><br><span class="line">        <span class="comment">// 取到符号的name</span></span><br><span class="line">        <span class="keyword">var</span> symbol = symbools[i].name;</span><br><span class="line">        <span class="comment">// 过滤一下，因为还有一个checkjni类中有该函数</span></span><br><span class="line">        <span class="keyword">if</span> (symbol.indexOf(<span class="string">&quot;CheckJNI&quot;</span>) == -<span class="number">1</span> &amp;&amp; symbol.indexOf(<span class="string">&quot;JNI&quot;</span>) &gt;= <span class="number">0</span>) &#123;</span><br><span class="line">            <span class="keyword">if</span> (symbol.indexOf(<span class="string">&quot;NewStringUTF&quot;</span>) &gt;= <span class="number">0</span>) &#123;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;finally found NewStringUTF_name:&quot;</span>, symbol);</span><br><span class="line">                <span class="comment">// 保存该函数的地址</span></span><br><span class="line">                NewStringUTF_addr = symbools[i].address;</span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;finally found NewStringUTF_address :&quot;</span>, NewStringUTF_addr);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// new一个NewStringUTF的NativeFunction</span></span><br><span class="line">    <span class="comment">/* static jstring NewStringUTF(JNIEnv* env, const char* utf) */</span></span><br><span class="line">    <span class="keyword">var</span> NewStringUTF = <span class="keyword">new</span> NativeFunction(NewStringUTF_addr, <span class="string">&quot;pointer&quot;</span>, [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line">    <span class="comment">// 然后执行替换</span></span><br><span class="line">    Interceptor.replace(</span><br><span class="line">        NewStringUTF_addr,</span><br><span class="line">        <span class="keyword">new</span> NativeCallback(</span><br><span class="line">            <span class="function"><span class="keyword">function</span> (<span class="params">arg1, arg2</span>) </span>&#123;</span><br><span class="line">                <span class="comment">// 打印原本的参数</span></span><br><span class="line">                <span class="built_in">console</span>.log(<span class="string">&quot;NewStringUTF arg1,arg2-&gt;&quot;</span>, arg1, arg2.readCString());</span><br><span class="line">                <span class="comment">// new一个char*字符串</span></span><br><span class="line">                <span class="keyword">var</span> newARG2 = Memory.allocUtf8String(<span class="string">&quot;newPARG2&quot;</span>);</span><br><span class="line">                <span class="comment">/* 将参数替换，然后执行原函数并返回结果</span></span><br><span class="line"><span class="comment">        var result=NewStringUTF(arg1,newARG2); // 不能随意修改，会导致崩溃*/</span></span><br><span class="line">                <span class="keyword">var</span> result = NewStringUTF(arg1, arg2);</span><br><span class="line">                <span class="keyword">return</span> result;</span><br><span class="line">            &#125;,</span><br><span class="line">            <span class="string">&quot;pointer&quot;</span>,</span><br><span class="line">            [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]</span><br><span class="line">        )</span><br><span class="line">    );</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h2 id="native层代码模板复用">native层代码模板复用<a class="header-anchor" href="#native层代码模板复用"> ¶ </a></h2>
<h3 id="Frida写文件">Frida写文件<a class="header-anchor" href="#Frida写文件"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment"> * 写文件</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>path 写文件的路径</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>contents 写文件的内容</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">writeSomething</span>(<span class="params">path, contents</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> fopen_addr = Module.findExportByName(<span class="string">&quot;libc.so&quot;</span>, <span class="string">&quot;fopen&quot;</span>);</span><br><span class="line">    <span class="keyword">var</span> fputs_addr = Module.findExportByName(<span class="string">&quot;libc.so&quot;</span>, <span class="string">&quot;fputs&quot;</span>);</span><br><span class="line">    <span class="keyword">var</span> fclose_addr = Module.findExportByName(<span class="string">&quot;libc.so&quot;</span>, <span class="string">&quot;fclose&quot;</span>);</span><br><span class="line"></span><br><span class="line">    <span class="comment">//console.log(&quot;fopen=&gt;&quot;,fopen_addr,&quot;  fputs=&gt;&quot;,fputs_addr,&quot;  fclose=&gt;&quot;,fclose_addr);</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> fopen = <span class="keyword">new</span> NativeFunction(fopen_addr, <span class="string">&quot;pointer&quot;</span>, [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line">    <span class="keyword">var</span> fputs = <span class="keyword">new</span> NativeFunction(fputs_addr, <span class="string">&quot;int&quot;</span>, [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line">    <span class="keyword">var</span> fclose = <span class="keyword">new</span> NativeFunction(fclose_addr, <span class="string">&quot;int&quot;</span>, [<span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line"></span><br><span class="line">    <span class="comment">//console.log(path,contents)</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> fileName = Memory.allocUtf8String(path);</span><br><span class="line">    <span class="keyword">var</span> mode = Memory.allocUtf8String(<span class="string">&quot;a+&quot;</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> fp = fopen(fileName, mode);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> contentHello = Memory.allocUtf8String(contents);</span><br><span class="line">    <span class="keyword">var</span> ret = fputs(contentHello, fp);</span><br><span class="line"></span><br><span class="line">    fclose(fp);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="遍历module的导出表与符号表">遍历module的导出表与符号表<a class="header-anchor" href="#遍历module的导出表与符号表"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment"> * 遍历导出表与符号表 Example</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/**</span></span><br><span class="line"><span class="comment"> * 写文件</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>path 写文件的路径</span></span><br><span class="line"><span class="comment"> * <span class="doctag">@param <span class="type">&#123;*&#125;</span> </span>contents 写文件的内容</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">writeSomething</span>(<span class="params">path, contents</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> fopen_addr = Module.findExportByName(<span class="string">&quot;libc.so&quot;</span>, <span class="string">&quot;fopen&quot;</span>);</span><br><span class="line">    <span class="keyword">var</span> fputs_addr = Module.findExportByName(<span class="string">&quot;libc.so&quot;</span>, <span class="string">&quot;fputs&quot;</span>);</span><br><span class="line">    <span class="keyword">var</span> fclose_addr = Module.findExportByName(<span class="string">&quot;libc.so&quot;</span>, <span class="string">&quot;fclose&quot;</span>);</span><br><span class="line"></span><br><span class="line">    <span class="comment">//console.log(&quot;fopen=&gt;&quot;,fopen_addr,&quot;  fputs=&gt;&quot;,fputs_addr,&quot;  fclose=&gt;&quot;,fclose_addr);</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> fopen = <span class="keyword">new</span> NativeFunction(fopen_addr, <span class="string">&quot;pointer&quot;</span>, [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line">    <span class="keyword">var</span> fputs = <span class="keyword">new</span> NativeFunction(fputs_addr, <span class="string">&quot;int&quot;</span>, [<span class="string">&quot;pointer&quot;</span>, <span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line">    <span class="keyword">var</span> fclose = <span class="keyword">new</span> NativeFunction(fclose_addr, <span class="string">&quot;int&quot;</span>, [<span class="string">&quot;pointer&quot;</span>]);</span><br><span class="line"></span><br><span class="line">    <span class="comment">//console.log(path,contents)</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> fileName = Memory.allocUtf8String(path);</span><br><span class="line">    <span class="keyword">var</span> mode = Memory.allocUtf8String(<span class="string">&quot;a+&quot;</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> fp = fopen(fileName, mode);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">var</span> contentHello = Memory.allocUtf8String(contents);</span><br><span class="line">    <span class="keyword">var</span> ret = fputs(contentHello, fp);</span><br><span class="line"></span><br><span class="line">    fclose(fp);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/** 对指定函数进行attachHOOK **/</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">attach</span>(<span class="params">name, address</span>) </span>&#123;</span><br><span class="line">    <span class="built_in">console</span>.log(<span class="string">&quot;attaching &quot;</span>, name);</span><br><span class="line">    Interceptor.attach(address, &#123;</span><br><span class="line">        <span class="attr">onEnter</span>: <span class="function"><span class="keyword">function</span> (<span class="params">args</span>) </span>&#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;Entering =&gt; &quot;</span>, name);</span><br><span class="line">        &#125;,</span><br><span class="line">        <span class="attr">onLeave</span>: <span class="function"><span class="keyword">function</span> (<span class="params">retval</span>) </span>&#123;</span><br><span class="line">            <span class="comment">//console.log(&quot;retval is =&gt; &quot;,retval)</span></span><br><span class="line">        &#125;,</span><br><span class="line">    &#125;);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">var</span> app_packagename = <span class="string">&quot;com.forgotten.learntest&quot;</span>;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* 遍历moudles的exports */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">traceNativeExport</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> modules = Process.enumerateModules();</span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; modules.length; i++) &#123;</span><br><span class="line">        <span class="keyword">var</span> <span class="built_in">module</span> = modules[i];</span><br><span class="line"></span><br><span class="line">        <span class="keyword">if</span> (<span class="built_in">module</span>.name.indexOf(<span class="string">&quot;libssl.so&quot;</span>) &lt; <span class="number">0</span>) &#123;</span><br><span class="line">            <span class="keyword">continue</span>;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> path = <span class="string">&quot;/data/data/&quot;</span> + app_packagename + <span class="string">&quot;/cache/&quot;</span> + <span class="built_in">module</span>.name + <span class="string">&quot;_exports.txt&quot;</span>;</span><br><span class="line">        <span class="keyword">var</span> <span class="built_in">exports</span> = <span class="built_in">module</span>.enumerateExports();</span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> j = <span class="number">0</span>; j &lt; <span class="built_in">exports</span>.length; j++) &#123;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;module name is =&gt;&quot;</span>, <span class="built_in">module</span>.name, <span class="string">&quot; symbol name is =&gt;&quot;</span>, <span class="built_in">exports</span>[j].name);</span><br><span class="line"></span><br><span class="line">            writeSomething(path, <span class="string">&quot;type: &quot;</span> + <span class="built_in">exports</span>[j].type + <span class="string">&quot; function name :&quot;</span> + <span class="built_in">exports</span>[j].name + <span class="string">&quot; address : &quot;</span> + <span class="built_in">exports</span>[j].address + <span class="string">&quot; offset =&gt; 0x&quot;</span> + <span class="built_in">exports</span>[j].address.sub(modules[i].base) + <span class="string">&quot;\n&quot;</span>);</span><br><span class="line">            <span class="keyword">if</span> (<span class="built_in">exports</span>[j].name.indexOf(<span class="string">&quot;SSL_write&quot;</span>) &gt;= <span class="number">0</span>) &#123;</span><br><span class="line">                attach(<span class="built_in">exports</span>[j].name, <span class="built_in">exports</span>[j].address);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">/* 遍历moudles的symbols */</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">traceNativeSymbol</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> modules = Process.enumerateModules();</span><br><span class="line">    <span class="keyword">for</span> (<span class="keyword">var</span> i = <span class="number">0</span>; i &lt; modules.length; i++) &#123;</span><br><span class="line">        <span class="keyword">var</span> <span class="built_in">module</span> = modules[i];</span><br><span class="line">        <span class="comment">// console.log(JSON.stringify(module));</span></span><br><span class="line">        <span class="comment">/*可以对指定module进行过滤*/</span></span><br><span class="line"></span><br><span class="line">        <span class="keyword">if</span> (<span class="built_in">module</span>.name.indexOf(<span class="string">&quot;linker64&quot;</span>) &lt; <span class="number">0</span>) &#123;</span><br><span class="line">            <span class="keyword">continue</span>;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">var</span> path = <span class="string">&quot;/data/data/&quot;</span> + app_packagename + <span class="string">&quot;/cache/&quot;</span> + <span class="built_in">module</span>.name + <span class="string">&quot;_symbols.txt&quot;</span>;</span><br><span class="line">        <span class="keyword">var</span> <span class="built_in">exports</span> = <span class="built_in">module</span>.enumerateSymbols();</span><br><span class="line">        <span class="comment">// console.log(JSON.stringify(exports))</span></span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> j = <span class="number">0</span>; j &lt; <span class="built_in">exports</span>.length; j++) &#123;</span><br><span class="line">            <span class="keyword">if</span> (<span class="built_in">exports</span>[j] == <span class="literal">null</span>) &#123;</span><br><span class="line">                <span class="keyword">continue</span>;</span><br><span class="line">            &#125;</span><br><span class="line">            <span class="built_in">console</span>.log(<span class="string">&quot;module name is =&gt;&quot;</span>, <span class="built_in">module</span>.name, <span class="string">&quot; symbol name is =&gt;&quot;</span>, <span class="built_in">exports</span>[j].name);</span><br><span class="line"></span><br><span class="line">            writeSomething(path, <span class="string">&quot;type: &quot;</span> + <span class="built_in">exports</span>[j].type + <span class="string">&quot; function name :&quot;</span> + <span class="built_in">exports</span>[j].name + <span class="string">&quot; address : &quot;</span> + <span class="built_in">exports</span>[j].address + <span class="string">&quot; offset =&gt; 0x&quot;</span> + <span class="built_in">exports</span>[j].address.sub(modules[i].base) + <span class="string">&quot;\n&quot;</span>);</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">main</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line">    <span class="built_in">console</span>.log(<span class="string">&quot;Entering main&quot;</span>);</span><br><span class="line">    traceNativeExport();</span><br><span class="line">    traceNativeSymbol();</span><br><span class="line">&#125;</span><br><span class="line">setImmediate(main);</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<h3 id="读写-std-string">读写 std::string<a class="header-anchor" href="#读写-std-string"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">readStdString</span>(<span class="params">str</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> isTiny = (str.readU8 &amp; <span class="number">1</span>) === <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">if</span> (isTiny) &#123;</span><br><span class="line">        <span class="keyword">return</span> str.add(<span class="number">1</span>).readUtf8String();</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">return</span> str</span><br><span class="line">        .add(<span class="number">2</span> * Process.pointerSize)</span><br><span class="line">        .readPointer()</span><br><span class="line">        .readUtf8String();</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">writeStdString</span>(<span class="params">str, content</span>) </span>&#123;</span><br><span class="line">    <span class="keyword">var</span> isTiny = (str.readU8() &amp; <span class="number">1</span>) === <span class="number">0</span>;</span><br><span class="line">    <span class="keyword">if</span> (isTiny) &#123;</span><br><span class="line">        str.add(<span class="number">1</span>).writeUtf8String(content);</span><br><span class="line">    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">        str.add(<span class="number">2</span> * Process.pointerSize)</span><br><span class="line">            .readPointer()</span><br><span class="line">            .writeUtf8String(content);</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="Frida打印String">Frida打印String[]<a class="header-anchor" href="#Frida打印String"> ¶ </a></h3>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">const</span> len = Java.vm.getEnv().getArrayLength(jstringArr);</span><br><span class="line"><span class="built_in">console</span>.log(<span class="string">&quot;len&quot;</span>, len);</span><br><span class="line"><span class="keyword">for</span>(<span class="keyword">var</span> i=<span class="number">0</span>;i&lt;len;i++)&#123;</span><br><span class="line">     <span class="keyword">var</span> obj = Java.vm.getEnv().getObjectArrayElement (jstringArr,i);</span><br><span class="line">     <span class="comment">// console.log(obj);</span></span><br><span class="line">     <span class="comment">// 方式一：</span></span><br><span class="line">     <span class="comment">// var element = Java.cast(obj, Java.use(&quot;java.lang.String&quot;));</span></span><br><span class="line">     <span class="comment">// 方式二：</span></span><br><span class="line">     <span class="keyword">var</span> element = Java.vm.getEnv().getStringUtfChars(obj, <span class="literal">null</span>).readCString();</span><br><span class="line">     <span class="built_in">console</span>.log(<span class="string">&quot;第&quot;</span>+i+<span class="string">&quot;个:&quot;</span>+ element)</span><br><span class="line"> &#125;</span><br></pre></td></tr></table></figure>
<h2 id="相关脚本使用">相关脚本使用<a class="header-anchor" href="#相关脚本使用"> ¶ </a></h2>
<h3 id="Unpackers">Unpackers<a class="header-anchor" href="#Unpackers"> ¶ </a></h3>
<h4 id="FRIDA-DEXDump-2">FRIDA-DEXDump<a class="header-anchor" href="#FRIDA-DEXDump-2"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/hluwa/FRIDA-DEXDump">hluwa/frida-dexdump: A frida tool to dump dex in memory to support security engineers analyzing malware. (github.com)</a></p>
<h4 id="frida-fart">frida_fart<a class="header-anchor" href="#frida-fart"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/hanbinglengyue/FART">hanbinglengyue/FART: ART环境下自动化脱壳方案 (github.com)</a></p>
<h4 id="frida-dump">frida_dump<a class="header-anchor" href="#frida-dump"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/lasting-yang/frida_dump">lasting-yang/frida_dump: frida dump dex, frida dump so (github.com)</a></p>
<h3 id="NetWork">NetWork<a class="header-anchor" href="#NetWork"> ¶ </a></h3>
<h4 id="r0capture">r0capture<a class="header-anchor" href="#r0capture"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/r0ysue/r0capture">r0ysue/r0capture: 安卓应用层抓包通杀脚本 (github.com)</a></p>
<h4 id="OkHttpLogger-Frida">OkHttpLogger-Frida<a class="header-anchor" href="#OkHttpLogger-Frida"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/siyujie/OkHttpLogger-Frida">siyujie/OkHttpLogger-Frida: Frida 实现拦截okhttp的脚本 (github.com)</a></p>
<h4 id="frida-ssl-logger">frida_ssl_logger<a class="header-anchor" href="#frida-ssl-logger"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/BigFaceCat2017/frida_ssl_logger">BigFaceCat2017/frida_ssl_logger: ssl_logger based on frida (github.com)</a></p>
<h4 id="okhttp-sslunpinning">okhttp-sslunpinning<a class="header-anchor" href="#okhttp-sslunpinning"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/bxl0608/okhttp-sslunpinning">bxl0608/okhttp-sslunpinning (github.com)</a></p>
<h3 id="Trace">Trace<a class="header-anchor" href="#Trace"> ¶ </a></h3>
<h4 id="jnitrace">jnitrace<a class="header-anchor" href="#jnitrace"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/chame1eon/jnitrace">chame1eon/jnitrace: A Frida based tool that traces usage of the JNI API in Android apps. (github.com)</a></p>
<h4 id="frida-hook-libart">frida_hook_libart<a class="header-anchor" href="#frida-hook-libart"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/lasting-yang/frida_hook_libart">lasting-yang/frida_hook_libart: Frida hook some jni functions (github.com)</a></p>
<h4 id="frida-trace">frida-trace<a class="header-anchor" href="#frida-trace"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://frida.re/docs/frida-trace/">frida-trace | Frida • A world-class dynamic instrumentation framework</a></p>
<h3 id="Memory">Memory<a class="header-anchor" href="#Memory"> ¶ </a></h3>
<h4 id="Wallbreaker-2">Wallbreaker<a class="header-anchor" href="#Wallbreaker-2"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/hluwa/Wallbreaker">hluwa/Wallbreaker: 🔨 Break Java Reverse Engineering form Memory World! (github.com)</a></p>
<h2 id="Or">Or<a class="header-anchor" href="#Or"> ¶ </a></h2>
<ul>
<li>
<p><a target="_blank" rel="noopener" href="https://eternalsakura13.com/2020/07/04/frida/">Frida Android hook | Sakuraのblog (eternalsakura13.com)</a></p>
</li>
<li>
<p><a target="_blank" rel="noopener" href="https://kevinspider.github.io/frida/frida-hook-java/">分类: frida | 凡墙总是门 (kevinspider.github.io)</a></p>
</li>
<li>
<p><a target="_blank" rel="noopener" href="https://kevinspider.github.io/frida/frida-hook-so/">分类: frida | 凡墙总是门 (kevinspider.github.io)</a></p>
</li>
</ul>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="mailto:undefined">Forgo7ten</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://forgo7ten.github.io/AndroidReverse/2022/Frida_all_in_one/">https://forgo7ten.github.io/AndroidReverse/2022/Frida_all_in_one/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://Forgo7ten.github.io" target="_blank">Forgo7ten'blog</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/tags/Android%E9%80%86%E5%90%91/">Android逆向</a></div><div class="post_share"><div class="social-share" data-image="http://forgo7ten.gitee.io/store/imgs/14.jpg" data-sites="facebook,twitter,wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/social-share.js/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/social-share.js/dist/js/social-share.min.js" defer></script></div></div><div class="post-reward"><div class="reward-button"><i class="fas fa-qrcode"></i> 打赏</div><div class="reward-main"><ul class="reward-all"><li class="reward-item"><a href="/images/wechat.png" target="_blank"><img class="post-qr-code-img" src="/images/wechat.png" alt="wechat"/></a><div class="post-qr-code-desc">wechat</div></li><li class="reward-item"><a href="/images/alipay.jpg" target="_blank"><img class="post-qr-code-img" src="/images/alipay.jpg" alt="alipay"/></a><div class="post-qr-code-desc">alipay</div></li></ul></div></div><nav class="pagination-post" id="pagination"><div class="prev-post pull-left"><a href="/AndroidReverse/2022/Learning_about_cryptographic_algorithms/"><img class="prev-cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of previous post"><div class="pagination-info"><div class="label">上一篇</div><div class="prev_info">对加密算法的学习</div></div></a></div><div class="next-post pull-right"><a href="/AndroidReverse/2022/Android_devices_init/"><img class="next-cover" src="http://forgo7ten.gitee.io/store/imgs/13.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of next post"><div class="pagination-info"><div class="label">下一篇</div><div class="next_info">Android刷机记录</div></div></a></div></nav><div class="relatedPosts"><div class="headline"><i class="fas fa-thumbs-up fa-fw"></i><span>相关推荐</span></div><div class="relatedPosts-list"><div><a href="/AndroidReverse/2021/Analysis_of_WeChat/" title="vx逆向分析随笔"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-08-14</div><div class="title">vx逆向分析随笔</div></div></a></div><div><a href="/AndroidReverse/2022/Android_dynamic_debugging_collection/" title="Android APK无源码动态调试合集"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/3.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-01-21</div><div class="title">Android APK无源码动态调试合集</div></div></a></div><div><a href="/AndroidReverse/2021/Initial_xposed_module_development/" title="Xposed 模块开发一 环境搭建"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/11.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-07-12</div><div class="title">Xposed 模块开发一 环境搭建</div></div></a></div><div><a href="/AndroidReverse/2022/Learning_about_cryptographic_algorithms/" title="对加密算法的学习"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-02-07</div><div class="title">对加密算法的学习</div></div></a></div><div><a href="/AndroidReverse/2022/Android_devices_init/" title="Android刷机记录"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/13.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-05-03</div><div class="title">Android刷机记录</div></div></a></div><div><a href="/AndroidReverse/2021/Android_traffic_capture_configuration_collection/" title="Android抓包配置合集"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/1.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-07-24</div><div class="title">Android抓包配置合集</div></div></a></div></div></div><hr/><div id="post-comment"><div class="comment-head"><div class="comment-headline"><i class="fas fa-comments fa-fw"></i><span> 评论</span></div></div><div class="comment-wrap"><div><div id="gitalk-container"></div></div></div></div></div><div class="aside-content" id="aside-content"><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#Frida-all-in-one"><span class="toc-number">1.</span> <span class="toc-text">Frida all in one</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#Frida%E7%8E%AF%E5%A2%83%E4%B8%8E%E5%9F%BA%E7%A1%80%E4%BD%BF%E7%94%A8"><span class="toc-number">1.1.</span> <span class="toc-text">Frida环境与基础使用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%A4%9Apython-frida%E7%89%88%E6%9C%AC%E5%88%87%E6%8D%A2"><span class="toc-number">1.1.1.</span> <span class="toc-text">多python frida版本切换</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#pyenv%E5%AE%89%E8%A3%85"><span class="toc-number">1.1.1.1.</span> <span class="toc-text">pyenv安装</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#pyenv%E4%BD%BF%E7%94%A8"><span class="toc-number">1.1.1.2.</span> <span class="toc-text">pyenv使用</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Frida%E7%8E%AF%E5%A2%83%E5%AE%89%E8%A3%85"><span class="toc-number">1.1.2.</span> <span class="toc-text">Frida环境安装</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%89%8B%E6%9C%BA%E7%8E%AF%E5%A2%83%E9%85%8D%E7%BD%AE"><span class="toc-number">1.1.2.1.</span> <span class="toc-text">手机环境配置</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#%E7%9B%91%E5%90%AC"><span class="toc-number">1.1.2.1.1.</span> <span class="toc-text">监听</span></a></li></ol></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Objection%E7%8E%AF%E5%A2%83%E5%AE%89%E8%A3%85"><span class="toc-number">1.1.3.</span> <span class="toc-text">Objection环境安装</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Frida%E5%BC%80%E5%8F%91%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA"><span class="toc-number">1.1.4.</span> <span class="toc-text">Frida开发环境搭建</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Objection%E4%BD%BF%E7%94%A8"><span class="toc-number">1.1.5.</span> <span class="toc-text">Objection使用</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#Objection%E5%9F%BA%E6%9C%AC%E4%BD%BF%E7%94%A8"><span class="toc-number">1.1.5.1.</span> <span class="toc-text">Objection基本使用</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#objection%E6%8F%92%E4%BB%B6"><span class="toc-number">1.1.5.2.</span> <span class="toc-text">objection插件</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Wallbreaker"><span class="toc-number">1.1.5.3.</span> <span class="toc-text">Wallbreaker</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#FRIDA-DEXDump"><span class="toc-number">1.1.5.4.</span> <span class="toc-text">FRIDA-DEXDump</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#objection%E9%AB%98%E7%BA%A7%E4%BD%BF%E7%94%A8"><span class="toc-number">1.1.5.5.</span> <span class="toc-text">objection高级使用</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Frida-Java%E5%B1%82%E5%BA%94%E7%94%A8"><span class="toc-number">1.2.</span> <span class="toc-text">Frida Java层应用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#hook%E6%96%B9%E6%B3%95"><span class="toc-number">1.2.1.</span> <span class="toc-text">hook方法</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#hook%E9%9D%99%E6%80%81%E6%96%B9%E6%B3%95%E4%B8%8E%E5%AE%9E%E4%BE%8B%E6%96%B9%E6%B3%95"><span class="toc-number">1.2.1.1.</span> <span class="toc-text">hook静态方法与实例方法</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook%E6%9E%84%E9%80%A0%E6%96%B9%E6%B3%95"><span class="toc-number">1.2.1.2.</span> <span class="toc-text">hook构造方法</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%AF%B9%E6%96%B9%E6%B3%95%E9%87%8D%E8%BD%BD%E7%9A%84hook"><span class="toc-number">1.2.1.3.</span> <span class="toc-text">对方法重载的hook</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook%E6%8C%87%E5%AE%9A%E6%96%B9%E6%B3%95%E7%9A%84%E6%89%80%E6%9C%89%E9%87%8D%E8%BD%BD"><span class="toc-number">1.2.1.4.</span> <span class="toc-text">hook指定方法的所有重载</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook%E5%86%85%E9%83%A8%E7%B1%BB%E4%B8%8E%E5%8C%BF%E5%90%8D%E7%B1%BB%E4%B8%AD%E7%9A%84%E6%96%B9%E6%B3%95"><span class="toc-number">1.2.1.5.</span> <span class="toc-text">hook内部类与匿名类中的方法</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E4%B8%8D%E5%8F%AF%E8%A7%81%E5%87%BD%E6%95%B0%E5%90%8Dhook"><span class="toc-number">1.2.1.6.</span> <span class="toc-text">不可见函数名hook</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%86%85%E5%AD%98%E6%90%9C%E7%B4%A2"><span class="toc-number">1.2.2.</span> <span class="toc-text">内存搜索</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%9F%A5%E6%89%BE%E5%AE%9E%E4%BE%8B%E5%AF%B9%E8%B1%A1"><span class="toc-number">1.2.2.1.</span> <span class="toc-text">查找实例对象</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E4%B8%BB%E5%8A%A8%E8%B0%83%E7%94%A8%E6%96%B9%E6%B3%95%E3%80%81%E8%8E%B7%E5%8F%96%E5%8F%8A%E4%BF%AE%E6%94%B9%E5%8F%98%E9%87%8F"><span class="toc-number">1.2.2.2.</span> <span class="toc-text">主动调用方法、获取及修改变量</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%9E%9A%E4%B8%BE%E6%89%80%E6%9C%89%E7%B1%BB%E5%B9%B6hook%E6%89%80%E6%9C%89%E6%96%B9%E6%B3%95"><span class="toc-number">1.2.2.3.</span> <span class="toc-text">枚举所有类并hook所有方法</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook%E5%8A%A8%E6%80%81%E5%8A%A0%E8%BD%BDdex"><span class="toc-number">1.2.2.4.</span> <span class="toc-text">hook动态加载dex</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%86%85%E5%AD%98%E6%90%9C%E7%B4%A2%E6%8E%A5%E5%8F%A3"><span class="toc-number">1.2.2.5.</span> <span class="toc-text">内存搜索接口</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#%E6%9E%9A%E4%B8%BE%E7%B1%BB%E7%9A%84%E6%89%80%E6%9C%89%E6%8E%A5%E5%8F%A3"><span class="toc-number">1.2.2.5.1.</span> <span class="toc-text">枚举类的所有接口</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#%E5%AF%BB%E6%89%BE%E6%8E%A5%E5%8F%A3%E7%9A%84%E5%AE%9E%E7%8E%B0%E7%B1%BB"><span class="toc-number">1.2.2.5.2.</span> <span class="toc-text">寻找接口的实现类</span></a></li></ol></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%AE%9A%E4%BD%8D%E6%8A%BD%E8%B1%A1%E7%B1%BB%E7%9A%84%E5%AE%9E%E7%8E%B0%E7%B1%BB"><span class="toc-number">1.2.2.6.</span> <span class="toc-text">定位抽象类的实现类</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#%E6%89%93%E5%8D%B0%E6%89%80%E6%9C%89%E7%B1%BB%E7%9A%84%E7%88%B6%E7%B1%BB"><span class="toc-number">1.2.2.6.1.</span> <span class="toc-text">打印所有类的父类</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#%E5%AF%BB%E6%89%BE%E7%BB%A7%E6%89%BF%E6%9F%90%E7%B1%BB%E7%9A%84%E5%AD%90%E7%B1%BB"><span class="toc-number">1.2.2.6.2.</span> <span class="toc-text">寻找继承某类的子类</span></a></li></ol></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%89%93%E5%8D%B0%E5%8F%82%E6%95%B0"><span class="toc-number">1.2.3.</span> <span class="toc-text">打印参数</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%8A%A0%E8%BD%BDdex%E4%BD%BF%E7%94%A8gson%E6%89%93%E5%8D%B0"><span class="toc-number">1.2.3.1.</span> <span class="toc-text">加载dex使用gson打印</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%9F%A5%E7%9C%8B%E7%B1%BB%E4%B8%8E%E7%B1%BB%E5%9E%8B%E5%BC%BA%E8%BD%AC"><span class="toc-number">1.2.3.2.</span> <span class="toc-text">查看类与类型强转</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Array%E6%95%B0%E7%BB%84"><span class="toc-number">1.2.3.3.</span> <span class="toc-text">Array数组</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#hook-array%E6%95%B0%E7%BB%84"><span class="toc-number">1.2.3.3.1.</span> <span class="toc-text">hook array数组</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#%E6%89%93%E5%8D%B0-array%E6%95%B0%E7%BB%84"><span class="toc-number">1.2.3.3.2.</span> <span class="toc-text">打印 array数组</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#byte-%E6%89%93%E5%8D%B0"><span class="toc-number">1.2.3.3.3.</span> <span class="toc-text">byte[]打印</span></a></li></ol></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%9E%9A%E4%B8%BE"><span class="toc-number">1.2.3.4.</span> <span class="toc-text">枚举</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#HashMap%E7%B1%BB%E5%9E%8B"><span class="toc-number">1.2.3.5.</span> <span class="toc-text">HashMap类型</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9E%84%E9%80%A0%E5%8F%82%E6%95%B0"><span class="toc-number">1.2.4.</span> <span class="toc-text">构造参数</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%9E%84%E9%80%A0Object"><span class="toc-number">1.2.4.1.</span> <span class="toc-text">构造Object[]</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#%E6%9E%84%E9%80%A0-array%E6%95%B0%E7%BB%84"><span class="toc-number">1.2.4.1.1.</span> <span class="toc-text">构造 array数组</span></a></li></ol></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Others"><span class="toc-number">1.2.5.</span> <span class="toc-text">Others</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#Frida%E6%9E%84%E9%80%A0%E5%A4%9A%E7%BA%BF%E7%A8%8B%EF%BC%88%E6%96%B0%E5%BB%BA%E7%B1%BB%EF%BC%89"><span class="toc-number">1.2.5.1.</span> <span class="toc-text">Frida构造多线程（新建类）</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E8%8E%B7%E5%8F%96context"><span class="toc-number">1.2.5.2.</span> <span class="toc-text">获取context</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%BC%BA%E5%88%B6%E4%B8%BB%E7%BA%BF%E7%A8%8B%E8%BF%90%E8%A1%8C"><span class="toc-number">1.2.5.3.</span> <span class="toc-text">强制主线程运行</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#java%E5%B1%82%E4%BB%A3%E7%A0%81%E6%A8%A1%E6%9D%BF%E5%A4%8D%E7%94%A8"><span class="toc-number">1.3.</span> <span class="toc-text">java层代码模板复用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%89%93%E5%8D%B0%E8%B0%83%E7%94%A8%E6%A0%88"><span class="toc-number">1.3.1.</span> <span class="toc-text">打印调用栈</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%A0%BC%E5%BC%8F%E5%8C%96%E6%89%93%E5%8D%B0%E5%8D%81%E5%85%AD%E8%BF%9B%E5%88%B6%E6%95%B0%E6%8D%AE"><span class="toc-number">1.3.2.</span> <span class="toc-text">格式化打印十六进制数据</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E4%BA%8B%E4%BB%B6"><span class="toc-number">1.3.3.</span> <span class="toc-text">事件</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#hook-Toast%E6%8F%90%E7%A4%BA-%E5%AE%9A%E4%BD%8D"><span class="toc-number">1.3.3.1.</span> <span class="toc-text">hook Toast提示 定位</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook-findViewById-%E5%AE%9A%E4%BD%8D%E7%BB%84%E4%BB%B6"><span class="toc-number">1.3.3.2.</span> <span class="toc-text">hook findViewById 定位组件</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook-StartActivity"><span class="toc-number">1.3.3.3.</span> <span class="toc-text">hook StartActivity</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#hook-onClick%E4%BA%8B%E4%BB%B6-%E5%AE%9A%E4%BD%8D"><span class="toc-number">1.3.3.4.</span> <span class="toc-text">hook onClick事件 定位</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#hook-Keystore%EF%BC%9A%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%AF%81%E4%B9%A6%E6%A0%A1%E9%AA%8C"><span class="toc-number">1.3.4.</span> <span class="toc-text">hook Keystore：客户端证书校验</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Frida-RPC-Remote-procedure-call"><span class="toc-number">1.4.</span> <span class="toc-text">Frida RPC(Remote procedure call)</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#RPC%E4%B8%BB%E5%8A%A8%E8%B0%83%E7%94%A8"><span class="toc-number">1.4.1.</span> <span class="toc-text">RPC主动调用</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#rpc%E5%8A%A8%E6%80%81%E4%BF%AE%E6%94%B9"><span class="toc-number">1.4.2.</span> <span class="toc-text">rpc动态修改</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#More"><span class="toc-number">1.4.3.</span> <span class="toc-text">More</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Frida-native%E5%B1%82%E5%BA%94%E7%94%A8"><span class="toc-number">1.5.</span> <span class="toc-text">Frida native层应用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%88%A4%E6%96%ADThumb-OR-arm"><span class="toc-number">1.5.1.</span> <span class="toc-text">判断Thumb OR arm</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#hook%E7%94%A8%E6%88%B7%E5%87%BD%E6%95%B0"><span class="toc-number">1.5.2.</span> <span class="toc-text">hook用户函数</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#attach%E9%9D%99%E6%80%81%E6%B3%A8%E5%86%8C-%E6%88%96%E5%AF%BC%E5%87%BA-%E5%87%BD%E6%95%B0"><span class="toc-number">1.5.2.1.</span> <span class="toc-text">attach静态注册(或导出)函数</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E4%B8%BB%E5%8A%A8%E8%B0%83%E7%94%A8%E9%9D%99%E6%80%81%E6%B3%A8%E5%86%8C-%E6%88%96%E5%AF%BC%E5%87%BA-%E5%87%BD%E6%95%B0"><span class="toc-number">1.5.2.2.</span> <span class="toc-text">主动调用静态注册(或导出)函数</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#replace%E9%9D%99%E6%80%81%E6%B3%A8%E5%86%8C-%E6%88%96%E5%AF%BC%E5%87%BA-%E5%87%BD%E6%95%B0"><span class="toc-number">1.5.2.3.</span> <span class="toc-text">replace静态注册(或导出)函数</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E9%80%9A%E8%BF%87%E5%9C%B0%E5%9D%80%E5%81%8F%E7%A7%BB%E6%93%8D%E4%BD%9C%E6%9C%AA%E5%AF%BC%E5%87%BA%E5%87%BD%E6%95%B0"><span class="toc-number">1.5.2.4.</span> <span class="toc-text">通过地址偏移操作未导出函数</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%A8%A1%E5%9D%97%E7%9B%B8%E5%85%B3%E6%93%8D%E4%BD%9C"><span class="toc-number">1.5.3.</span> <span class="toc-text">模块相关操作</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%9E%9A%E4%B8%BE%E5%87%BA%E6%89%80%E6%9C%89%E6%A8%A1%E5%9D%97%E7%9A%84%E6%89%80%E6%9C%89%E5%AF%BC%E5%87%BA%E7%AC%A6%E5%8F%B7"><span class="toc-number">1.5.3.1.</span> <span class="toc-text">枚举出所有模块的所有导出符号</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E9%81%8D%E5%8E%86%E6%9F%90%E6%A8%A1%E5%9D%97%E7%AC%A6%E5%8F%B7-%E5%AF%BC%E5%87%BA-%E5%AF%BC%E5%85%A5"><span class="toc-number">1.5.3.2.</span> <span class="toc-text">遍历某模块符号&#x2F;导出&#x2F;导入</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#JNI%E6%A1%86%E6%9E%B6%E5%B1%82%E7%9A%84%E5%88%A9%E7%94%A8"><span class="toc-number">1.5.4.</span> <span class="toc-text">JNI框架层的利用</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#JNI%E6%A1%86%E6%9E%B6hook%EF%BC%9A"><span class="toc-number">1.5.4.1.</span> <span class="toc-text">JNI框架hook：</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#JNI%E6%A1%86%E6%9E%B6replace%EF%BC%9A"><span class="toc-number">1.5.4.2.</span> <span class="toc-text">JNI框架replace：</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#native%E5%B1%82%E4%BB%A3%E7%A0%81%E6%A8%A1%E6%9D%BF%E5%A4%8D%E7%94%A8"><span class="toc-number">1.6.</span> <span class="toc-text">native层代码模板复用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#Frida%E5%86%99%E6%96%87%E4%BB%B6"><span class="toc-number">1.6.1.</span> <span class="toc-text">Frida写文件</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E9%81%8D%E5%8E%86module%E7%9A%84%E5%AF%BC%E5%87%BA%E8%A1%A8%E4%B8%8E%E7%AC%A6%E5%8F%B7%E8%A1%A8"><span class="toc-number">1.6.2.</span> <span class="toc-text">遍历module的导出表与符号表</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E8%AF%BB%E5%86%99-std-string"><span class="toc-number">1.6.3.</span> <span class="toc-text">读写 std::string</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Frida%E6%89%93%E5%8D%B0String"><span class="toc-number">1.6.4.</span> <span class="toc-text">Frida打印String[]</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E7%9B%B8%E5%85%B3%E8%84%9A%E6%9C%AC%E4%BD%BF%E7%94%A8"><span class="toc-number">1.7.</span> <span class="toc-text">相关脚本使用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#Unpackers"><span class="toc-number">1.7.1.</span> <span class="toc-text">Unpackers</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#FRIDA-DEXDump-2"><span class="toc-number">1.7.1.1.</span> <span class="toc-text">FRIDA-DEXDump</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#frida-fart"><span class="toc-number">1.7.1.2.</span> <span class="toc-text">frida_fart</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#frida-dump"><span class="toc-number">1.7.1.3.</span> <span class="toc-text">frida_dump</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#NetWork"><span class="toc-number">1.7.2.</span> <span class="toc-text">NetWork</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#r0capture"><span class="toc-number">1.7.2.1.</span> <span class="toc-text">r0capture</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#OkHttpLogger-Frida"><span class="toc-number">1.7.2.2.</span> <span class="toc-text">OkHttpLogger-Frida</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#frida-ssl-logger"><span class="toc-number">1.7.2.3.</span> <span class="toc-text">frida_ssl_logger</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#okhttp-sslunpinning"><span class="toc-number">1.7.2.4.</span> <span class="toc-text">okhttp-sslunpinning</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Trace"><span class="toc-number">1.7.3.</span> <span class="toc-text">Trace</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#jnitrace"><span class="toc-number">1.7.3.1.</span> <span class="toc-text">jnitrace</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#frida-hook-libart"><span class="toc-number">1.7.3.2.</span> <span class="toc-text">frida_hook_libart</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#frida-trace"><span class="toc-number">1.7.3.3.</span> <span class="toc-text">frida-trace</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Memory"><span class="toc-number">1.7.4.</span> <span class="toc-text">Memory</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#Wallbreaker-2"><span class="toc-number">1.7.4.1.</span> <span class="toc-text">Wallbreaker</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Or"><span class="toc-number">1.8.</span> <span class="toc-text">Or</span></a></li></ol></li></ol></div></div></div></div></main><footer id="footer" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/14.jpg')"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2023 By Forgo7ten</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div><div class="footer_custom_text">Hi, welcome to my <a href="https://Forgo7ten.github.io/">blog</a>!</div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="translateLink" type="button" title="简繁转换">繁</button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><a id="to_comment" href="#post-comment" title="直达评论"><i class="fas fa-comments"></i></a><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div id="local-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">本地搜索</span><span id="loading-status"></span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="is-center" id="loading-database"><i class="fas fa-spinner fa-pulse"></i><span>  数据库加载中</span></div><div class="search-wrap"><div id="local-search-input"><div class="local-search-box"><input class="local-search-box--input" placeholder="搜索文章" type="text"/></div></div><hr/><div id="local-search-results"></div></div></div><div id="search-mask"></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="/js/tw_cn.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.js"></script><script src="https://cdn.jsdelivr.net/npm/instant.page/instantpage.min.js" type="module"></script><script src="https://cdn.jsdelivr.net/npm/vanilla-lazyload/dist/lazyload.iife.min.js"></script><script src="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.js"></script><script src="/js/search/local-search.js"></script><script>var preloader = {
  endLoading: () => {
    document.body.style.overflow = 'auto';
    document.getElementById('loading-box').classList.add("loaded")
  },
  initLoading: () => {
    document.body.style.overflow = '';
    document.getElementById('loading-box').classList.remove("loaded")

  }
}
window.addEventListener('load',preloader.endLoading())</script><div class="js-pjax"><script>function addGitalkSource () {
  const ele = document.createElement('link')
  ele.rel = 'stylesheet'
  ele.href= 'https://cdn.jsdelivr.net/npm/gitalk/dist/gitalk.min.css'
  document.getElementsByTagName('head')[0].appendChild(ele)
}

function loadGitalk () {
  function initGitalk () {
    var gitalk = new Gitalk(Object.assign({
      clientID: '9e01c692fcf5a9e47867',
      clientSecret: '6d5297eda0643a171a9e5510f5ea1c29ad851389',
      repo: 'Forgo7ten.github.io',
      owner: 'Forgo7ten',
      admin: ['Forgo7ten'],
      id: 'fc93c6775f721bd7dd96ed6424a44b83',
      updateCountCallback: commentCount
    },{"language":"en","perPage":20,"distractionFreeMode":true,"pagerDirection":"last","createIssueManually":true}))

    gitalk.render('gitalk-container')
  }

  if (typeof Gitalk === 'function') initGitalk()
  else {
    addGitalkSource()
    getScript('https://cdn.jsdelivr.net/npm/gitalk@latest/dist/gitalk.min.js').then(initGitalk)
  }
}

function commentCount(n){
  let isCommentCount = document.querySelector('#post-meta .gitalk-comment-count')
  if (isCommentCount) {
    isCommentCount.innerHTML= n
  }
}

if ('Gitalk' === 'Gitalk' || !false) {
  if (false) btf.loadComment(document.getElementById('gitalk-container'), loadGitalk)
  else loadGitalk()
} else {
  function loadOtherComment () {
    loadGitalk()
  }
}</script></div><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/activate-power-mode.min.js"></script><script>POWERMODE.colorful = true;
POWERMODE.shake = true;
POWERMODE.mobile = false;
document.body.addEventListener('input', POWERMODE);
</script><script id="click-show-text" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/click-show-text.min.js" data-mobile="false" data-text="ヾ(≧▽≦*)o 点个收藏叭,(*^▽^*),w(ﾟДﾟ)w,ㄟ(≧◇≦)ㄏ,(/≧▽≦)/点个关注叭,Σ(っ °Д °;)っ,(●ˇ∀ˇ●),( •̀ ω •́ )✧,(*/ω＼*),ヽ(*。&gt;Д&lt;)o゜真的不收藏一下嘛,(～o￣3￣)～,ヽ（≧□≦）ノ" data-fontsize="15px" data-random="false" async="async"></script><script src="https://cdn.jsdelivr.net/npm/pjax/pjax.min.js"></script><script>let pjaxSelectors = ["title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]

var pjax = new Pjax({
  elements: 'a:not([target="_blank"])',
  selectors: pjaxSelectors,
  cacheBust: false,
  analytics: false,
  scrollRestoration: false
})

document.addEventListener('pjax:send', function () {

  // removeEventListener scroll 
  window.tocScrollFn && window.removeEventListener('scroll', window.tocScrollFn)
  window.scrollCollect && window.removeEventListener('scroll', scrollCollect)

  typeof preloader === 'object' && preloader.initLoading()
  document.getElementById('rightside').style.cssText = "opacity: ''; transform: ''"
  
  if (window.aplayers) {
    for (let i = 0; i < window.aplayers.length; i++) {
      if (!window.aplayers[i].options.fixed) {
        window.aplayers[i].destroy()
      }
    }
  }

  typeof typed === 'object' && typed.destroy()

  //reset readmode
  const $bodyClassList = document.body.classList
  $bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')

})

document.addEventListener('pjax:complete', function () {
  window.refreshFn()

  document.querySelectorAll('script[data-pjax]').forEach(item => {
    const newScript = document.createElement('script')
    const content = item.text || item.textContent || item.innerHTML || ""
    Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
    newScript.appendChild(document.createTextNode(content))
    item.parentNode.replaceChild(newScript, item)
  })

  GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()

  typeof chatBtnFn === 'function' && chatBtnFn()
  typeof panguInit === 'function' && panguInit()

  // google analytics
  typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});

  // baidu analytics
  typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);

  typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()

  // prismjs
  typeof Prism === 'object' && Prism.highlightAll()

  typeof preloader === 'object' && preloader.endLoading()
})

document.addEventListener('pjax:error', (e) => {
  if (e.request.status === 404) {
    pjax.loadUrl('/404.html')
  }
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"scale":1,"hHeadPos":0.5,"vHeadPos":0.618,"jsonPath":"/live2dw/assets/z16.model.json"},"display":{"superSample":2,"width":200,"height":400,"position":"right","hOffset":0,"vOffset":-20},"mobile":{"show":true,"scale":0.5},"react":{"opacityDefault":0.7,"opacityOnHover":0.2},"log":false});</script></body></html>